Added a new interface to Sophos SG UTM but cannot open any ports on it

You might have to pick new ports or change the transparent proxy in UTM (Web Protection > Filtering Options > Misc tab).  Port 8080 is there by default.  You may have to change that port to something else, maybe 8081 or another you aren't using.

I would also not use 'Any' as your source.  Define your network(s) instead, that's a potential security issue.  Also, make sure you enable the rule once you create it (it's off by default).  ;)

Thanks for the reply Amodin

I tried creating 2x redirected port rules (TCP 12345 > 8080 & TCP 12346 > 8090) but still nothing. The Firewall logs are showing the traffic as being dropped.

I have 3x firmware updates to apply (currently on 9.705-3) but I'll have to do these tomorrow when I know nobody is connected remotely. I doubt this will fix it though.

I can't help but feel I've missed something on the interface settings or similar.

Oh the "Any" on the source of the firewall rule is imply for testing purposes - I would usually have this set to "Internet IPV4" as the sole purpose of this server is a public facing web server but I appreciate the heads up.

Paul Kavanagh said:

I can't help but feel I've missed something on the interface settings or similar.

Can you take a screenshot and drag it into a reply window of what you think you might have set incorrectly?  We can see what your setup is.  Feel free to edit any revealing IPs.

I would also copy/paste some of your logs showing the blocking taking place so we can read those lines.

Pics show interfaces, Firewall Rules for the new VM & Network (172.16.0.X), Masquerading rule (not sure if required?) & logs showing drops. 86.11.141.252 is my home broadband IP.

Although TCP 8080 is required, client connections come in on TCP 8090 so I haven't yet changed the web filtering port.

I've also just updated the SG125 to the latest available firmware (9.707-5) which also rebooted it. Still no change.

I'm sure it's something simple and quite fundamental but I just can't think what it is.

Thanks!

if you wish to allow access from internet to your server, you need a DNAT-rule.

Source=any - Service=8090+8090 -> destination=external Interface IP .... change destination to "your Server"  

... and i would check the 2 checkboxes for Firewall-Rule and logging

Wow - so that worked!

Thank you so much!

I did have DNAT rules in before but the mistake I made was my rule was like:

Source= Internet IPV4 - Service=8090+8090 -> destination=VM Server 

It's kinda common sense now in hindsight but isn't that always the way?....

Thanks again for the help guys - really appreciate that.

Dirk beat me to it.  ;)  Glad it's working for you.