DNAT to load balancer VIP

Hello there,

Good day and thanks for reaching out to Sophos Community

Could you refer to this UTM doc guide: https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/NetProtServerLoadBalancingRules.htm

In this guide example states: - Suppose that you have two HTTP/S servers in your DMZ with the IP addresses 192.168.66.10 and 192.168.66.20, respectively. Assumed further you want to distribute HTTP/S traffic arriving on the external interface of your gateway equally to both servers. To set up a load balancing rule, select or create a host definition for each server. You may call them http_server_1 and http_server_2. Then, in the Create New Load Balancing Rule dialog box, select HTTP as Service. In addition, select the external address of the gateway as Virtual server. Finally, put the host definitions into the Real servers box.

Kindly let us know how it goes. Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hello there,

Good day and thanks for reaching out to Sophos Community

Could you refer to this UTM doc guide: https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/NetProtServerLoadBalancingRules.htm

In this guide example states: - Suppose that you have two HTTP/S servers in your DMZ with the IP addresses 192.168.66.10 and 192.168.66.20, respectively. Assumed further you want to distribute HTTP/S traffic arriving on the external interface of your gateway equally to both servers. To set up a load balancing rule, select or create a host definition for each server. You may call them http_server_1 and http_server_2. Then, in the Create New Load Balancing Rule dialog box, select HTTP as Service. In addition, select the external address of the gateway as Virtual server. Finally, put the host definitions into the Real servers box.

Kindly let us know how it goes. Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Thanks for your response.

How do I secure that? I obviously don't want to explose my database cluster to the world.

Do not create the automatic firewall rule, but create a rule manually to allow only the source subnet access to port 3306?

Hello Harro,

yes, with manual rules you could restrict access and source ips further.

Sorry for the late response, I needed the client to be able to test it.

The configuration is a bit weird imho.

I needed to define an LB rule: public IP:3306 -> IP of the database nodes, but a firewall rule: client IP:3306 -> IP of the database nodes, instead of what I expected, client IP:3306 -> public IP.

But this works. Thanks for the reponses everyone.