Multiple outgoing IP's with single WAN port

Hoi Hugo and welcome to the UTM Community!

With NAT rules, e.g.,

SNAT : {10.0.0.8) -> Any -> Internet : from {x.x.x.8}

Cheers - Bob
Note in #2 in Rulz that your DNAT makes your WAF setup ineffective.

Thank you BAlfson,

I only mentioned the DNAT rule as an alternative that was also working, I'm not using them together, but thank you for the rulez list. That's very nice.

Unfortunately the SNAT didn't work.

FROM: 10.0.0.8
Service: any
Going to: External WAN address (x.x.x.7)

Change source: x.x.x.8

But nothing happens.

WAF makes UTM the "owner" of the IP address.   Traffic reaches the web server by relaying from <internet client> to <WAF Address> to <internal webserver address>.   The WAF address is no longer available for internal devices to use for outgoing traffic.

UTM WAF supports SNI, so you could stack some or all of your WAF sites onto one IP, so that you free up the other addresses for other purposes.   The transition may involve some downtime for some users because of DNS propagation delays.   By SNI, I mean the following:

• DNS names:
  • server1.mycompany.com x.x.x.8
  • server2.mycompany.com x.x.x.8
  • server3.mycompany.com x.x.x.8
• WAF virtual webservers to match the DNS entries
• Users must use host names instead of IP addresses.

You can even define a catchall site for *.mycompany.com.

All of this may require https, I don't remember with certainty because all of my websites use https certificates (and so should yours).

Hello Douglas,

All your changes involve incoming requests. I'm asking about outgoing requests. How can I make {internal ip} access the outside world on {additional external address} instead of {interface external address}. because now they are all using the interface address.

As I said, those WAF addresses are not available for outgoing traffic, so you need to buy more addresses or free up some of them.   Overloading the WAF sites onto one address is a way to free them up.

I already have more additional address (not used anywhere in Sophos, except created as "additional address"). How do I set it up then?

For outbound connections only, use SNAT, where the source is your internal server, as Bob Alfson indicated earlier.

If you need inbound and outbound connections, you use full NAT, with firewall rules to block ports that should not be allowed in, especially the ports that are supposed to go through WAF.

You NAT rule is incorrect.

Not

Going to: External WAN address

But

Going to: Internet

Cheers - Bob