This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allow a remote user access to one LAN IP/node [SOLVED]

I'm not how to search for this question, please excuse me if it has been answered a few times.

We have contractors that need to remote back into our building and gain access to one server.  I'm not sure what I have done wrong in the setup. When I log in with a test account I can ping the server, but I can not access it's shares

Here's a description of what I have tried.

Sophos UTM 320
Firmware version: 9.313-3

1  I created a user and gave them the access to log into our network, and tested that the account can log in.
2  I then created a host with the IP address of the server I am trying to grant access and a host for the NetBIOS name and FQDN.
3  Then created a group for hosts, that way if I want to expand access I can just create the host/network and add it to the group
4  I then created a firewall rule that only allows access from theSource  user with a Service ofany and a Destination of LAN DNS and the group containing the IP/hostnames of the server.

I appreciate any insight someone might offer.

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 8 years ago

I am testing with a PPTP connection, but the end user will have the Sophos Open VPN Client for access.
Why don't we test with the SSL VPN then. Apples to Apples.

I added some addition questions to my original response, which you must have missed.
Did you modify the the VPN Poool addressing from the default 10.242.X.0?
Did you do the ping test and share access by IP, hostname, or FQDN?

Did you populate the information at Remote Access > Advanced? Domain Name won't work for for PPTP, but will for SSL.
Does the network that the test client is on and network the server is on have the same addressing?
In the host definition object for the server, did you bind it to a specific interface?
You only have a MASQ rule for Internal(network) to your WAN address, right?

Firewall Log was not that informative, when I checked, I wasn't able to see the PC trying to browse to any thing, at least in real time. Eventually there were entries, 2 kinds, Default drop or allowed due to the firewall rule I had created. But I couldn't perform any action that reflected in an immediate firewall logged response.
Start with the Live Log to see the real time entries (could be a slight delay if the system is under heavy load), can switch to the Full log for more detail.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Scott_Klassen over 8 years ago

I am testing with a PPTP connection, but the end user will have the Sophos Open VPN Client for access.
Why don't we test with the SSL VPN then. Apples to Apples.

I added some addition questions to my original response, which you must have missed.
Did you modify the the VPN Poool addressing from the default 10.242.X.0?
Did you do the ping test and share access by IP, hostname, or FQDN?

Did you populate the information at Remote Access > Advanced? Domain Name won't work for for PPTP, but will for SSL.
Does the network that the test client is on and network the server is on have the same addressing?
In the host definition object for the server, did you bind it to a specific interface?
You only have a MASQ rule for Internal(network) to your WAN address, right?

Firewall Log was not that informative, when I checked, I wasn't able to see the PC trying to browse to any thing, at least in real time. Eventually there were entries, 2 kinds, Default drop or allowed due to the firewall rule I had created. But I couldn't perform any action that reflected in an immediate firewall logged response.
Start with the Live Log to see the real time entries (could be a slight delay if the system is under heavy load), can switch to the Full log for more detail.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data