Routing to internal network doesn't work

Hi Peter and welcome to the UTM Community!

What insights do you get from doing #1 in Rulz?

Cheers - Bob

- Firewall log shows it's being forwarded

- Intrusion prevention log doesn't show anything

- Application control is disabled

- Advanced Threat Protection is zero

The .43.2 IP is the one assigned by the UTM from "VPN Pool (PPTP)" or ???

Cheers - Bob

Yes!

Does #3.1 in Rulz help?

Cheers - Bob

Unfortunately not :(

Devices in the LAN must have the IP of "Internal (Address)" as their default gateway.

--> All devices use the utm as default gateway

Never connect two NICs into the same, physical Ethernet segment unless bridging or creating a LAG.

--> This isn't the case

When adding an interface, don't forget the Masquerading rule for the new network behind the UTM.

--> Done, no effect

Would you be able to check the configuration with me? We could use teamviewer.

Next week would work for me.

I might add that i also can't ping an external host from the network (i.e. google.com) even though this is allowed in the icmp rules :/.

I might add that i also can't ping an external host from the network (i.e. google.com) even though this is allowed in the icmp rules :/.

Have you checked the Firewall Advanced section Connection Tracking helpers? is PPTP ticked?

and for one of the application we use internally (very old RDP outbound route) I had to create a DNAT rule.

for traffic From RDP Server

Using Service Microsoft Remote Desktop (RDP)

Going to Ext/Int Interface (IP not network)

Change Destination to Int/Ext Interface (IP not network, again)

took me w while to work this one out with help from Sophos Support (on the phone for over 2 hours - very helpful - can't thank them enough)

Hope this helps Peter

I don't understand, Jason - how about pictures?  Where's the RDP server?  Where are the clients?

Cheers - Bob

Yes, it's ticked.

I would bet it's a routing issue. 192.168.43.0/24 is not the default for PPTP Pool on UTM, so I take it you have changed to accommodate it into some existing LAN. I would start by looking where the reply from your server to the packet coming from 192.168.43.2 if going. You might find out it's not going back to the UTM at all.

Regards,

Giovani

I also tried different networks and used the default for L2TP. Nothing works.

Anyone able to help me?

Hi Peter.

You should try a tcpdump on the internal interface while testing the communication and see if packets are getting through and back. This kind of issues normally lies on the fact that the destination server does not know how to reply to the packets it receives.

Regards,

Giovani