Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 4 subscribers
  • Views 2243 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Let's Encrypt - Default Drop when NAT to internal

samson b

We recently changed ISPs and I haven't been able to renew the Let's Encrypt cert for UTM sophos.mydomain.com... i cloned all the rules and added new interfaces and the migration to new ISP went flawless.

I have a NAT rule I turn on when it's time to renew the LE cert:

DNAT    [Sophos SSL Let's Encrypt Renewals]

Traffic selector:               Any       →                         HTTP (80)     →                        External [Sophos] (Address)

Destination translation:               Internal (Address)

Automatic Firewall rule: Checked

Using Port Query, I can see It is applying NAT to the External IP, however it is dropping access to the internal destination on port 80.

14:41:29

NAT rule #1

TCP

 

My.remote.IP

:

10664

→

External [Sophos] (Address)

:

80

[SYN]

len=52

ttl=115

tos=0x00

 

 

14:41:29

Default DROP

TCP

My.remote.IP

:

10664

→

192.168.1.1

:

80

 

[SYN]

len=52

ttl=115

tos=0x00

Any idea why it would be dropping the internal address?

Sophos UTM 9.703-3

Appreciate the help!



This thread was automatically locked due to age.
Parents
  • 0

    Hello Samson,

    Thank you for contacting the Sophos Community!

    Maybe I am confused, but why do you have a DNAT rule for the Let's Encrypt certificate? Let's Encrypt needs to read your WAN interface FQDN name. 

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • +1 in reply to emmosophos

    Thanks for your response! It actually made me think about it and I realized I made a stupid mistake. It has been awhile and I forgot the LE cert was bound to a specific interface.

    The old LE cert had the old interface specified. I'm not sure how I missed that. It's kind of like when I can't find that thing in the drawer and it's right in front of my face!

    I simply needed to create a new LE cert on the new, correct interface, changed cert settings under WebAdmin and User Portal, and delete the old one.

Reply
  • +1 in reply to emmosophos

    Thanks for your response! It actually made me think about it and I realized I made a stupid mistake. It has been awhile and I forgot the LE cert was bound to a specific interface.

    The old LE cert had the old interface specified. I'm not sure how I missed that. It's kind of like when I can't find that thing in the drawer and it's right in front of my face!

    I simply needed to create a new LE cert on the new, correct interface, changed cert settings under WebAdmin and User Portal, and delete the old one.

Children
Unfiltered HTML