This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to disable IPv6 NAT

So I finally have an Internet connection with IPv6 addressing and thought I had everything setup correctly. I'm able to get to IPv6 sites without a problem however I'm unable to disable the NAT. I changed the masquerading rule to only NAT v4 stuff like so:

However when I go to any test site (or my own server for that matter) I always get the "Native over WAN" address of my Sophos box rather than the actual IP of the machine behind it:

When I do an IP config on my laptop I can see that I have an address from the delegated prefix:

Is there something else I need to do to fully disable the IPv6 NAT? Thanks!!

This thread was automatically locked due to age.

Parents

0 DavisDarvish over 8 years ago

It is your web protection i believe. If you disable web protection you should not have that issue anymore...
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 8 years ago in reply to DavisDarvish

Just tried disabling the web protection as a test. With it shut off IPv6 doesn't work at all. That's not a solution anyway, I don't want to disable the web protection...
Cancel
Vote Up 0 Vote Down

Cancel
0 dms over 7 years ago in reply to danodemano

Did you ever get to the bottom of this as I have the same issue?
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to dms

Nope, still natted. :/
Cancel
Vote Up 0 Vote Down

Cancel
+1 Ben over 7 years ago in reply to danodemano

this is not a bug, its a feature

you are using the proxy through web protection, so the sophos utm acts as a proxy and filters the websites

its technically not possible that the sophos acts on behalf of your clients IPv6 while still using web protection/proxy.

This is how it is supposed to be.

---

Sophos UTM 9.3 Certified Engineer
Cancel
Vote Up 0 Vote Down

Cancel
0 dms over 7 years ago in reply to Ben

I did a bit of playing last night and now have my IPv6 traffic non-natted having tweaked my NAT rules (I don't use web filtering). But when I do switch on filtering, as a test, NATting comes straight back again. So I agree, it's a feature of web filtering.
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to Ben

Well that's pretty annoying.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ben over 7 years ago in reply to danodemano

why is it annoying?

as i explained, using a proxy comes with also having its IP adress in use, there is no way around that!

technically speaking using a proxy has nothing to do with NAT - at all -

---

Sophos UTM 9.3 Certified Engineer
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to Ben

Because I would like to use web filtering AND IPv6 while letting each client maintain their own IPv6 address.
Cancel
Vote Up 0 Vote Down

Cancel
0 dms over 7 years ago in reply to danodemano

I guess that's the compromise you have to take if you switch on web filtering. You could disable web filtering (proxying) and use content filtering at the DNS layer with a service such as Norton ConnectSafe or OpenDNS Family Shield instead. You'll get similar protection to what the UTM would give you but without the hassle of local proxying.
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to dms

Yeah I could but I get more value our of the web filtering on the UTM with virus scanning and all that stuff. Plus I have different rules for my different segments (guest, kids, media, etc). I guess it is what it is....just annoying as I said before. :/
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 7 years ago in reply to danodemano

If you don't have any IPv4 clients on an Ethernet segment, I would try bridging that Interface with External and using a Full Transparent Profile. Any better luck with that?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 7 years ago in reply to danodemano

If you don't have any IPv4 clients on an Ethernet segment, I would try bridging that Interface with External and using a Full Transparent Profile. Any better luck with that?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 danodemano over 7 years ago in reply to BAlfson

Unfortunately I have IPv4 clients on all segments, running dual-stack across the board. I would love to go straight IPv6 but the world isn't quite there yet. ;)
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 7 years ago in reply to danodemano

Hmmmmm. I wonder if you could do a separate, Full Transparent Web Filtering Profile without a bridge for an IPv6 subnet. The bridge should only be necessary for IPv4, I'm thinkin'. Any luck with that?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to BAlfson

It says that full transparent is only available when it's running in bridge mode. Are you saying convert the box to bridge mode then try that? I'm not sure I'm willing to go down that route...and I would need another firewall to go in front which I don't have at this time.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 7 years ago in reply to danodemano

You mean you tried that and it wouldn't let you? I guess that's a feature added fairly recently.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to BAlfson

Yeah, "full transparent" is greyed out and if you hover over the little "i" it says it only works in bridge mode:
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 7 years ago in reply to danodemano

Sounds like it's time for a feature suggestion (Ideas)! WebAdmin should be smart enough to know that you put an IPv6 subnet in 'Allowed Networks'.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 danodemano over 7 years ago in reply to BAlfson

Oh, I didn't realize I needed to put an IPv6 network in the "allowed networks" box

Double oh, it still doesn't work. :(
Cancel
Vote Up 0 Vote Down

Cancel