Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 16 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 31440 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Changing the IP used on outbound proxy traffic

andrew.matthews
Hi,
I've just moved over to BT Infinity for Business as my ISP.

To use BT Infinity, you have to use their VDSL modem.  They supply a router, but you can use other routers if you choose to.  To get Astaro to work, you have to connect to the BT network using PPPOE and you get allocated a DHCP address which is fine.

You can also have static IP addresses allocated and this is where my question starts.

I've added the additional IP addresses as additional addresses on the ethernet adaptor that connects to BT.  So my external interface has a DHCP address and my additional six static IP addresses.  These IP addresses are visible to the internet as e-mail flows in and out, and VPN works as expected.

However, when I use the Web Filtering, all web traffic goes out onto the internet using the DHCP allocated IP address.  How can I change this so that is uses one of the static IP addresses?


This thread was automatically locked due to age.
  • 0
    If you have added an additional address to the external interface you have to go to:

    NetworkSecurity -> NAT -> Maquerading -> Edit the masquerading rule for your external interface

    Then chance "Use address: " to your new additional address.

    Then it should work.

    Viele Grüße

    Peter
  • 0 in reply to Peter D
    Thanks for the reply Peter.

    I've already set the masquerading rule up.

    If I turn off Web Filtering under Web Security, then all web traffic leaves via the masqueraded address.  If Web Filtering is on, then is uses the DHCP address allocated by BT.

    Any other ideas/suggestions would be most welcome.
  • 0
    Create an SNAT for outbound web surfing traffic.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to Scott_Klassen
    Create an SNAT for outbound web surfing traffic.


    Thanks for replying Scott, but considering that it is ignoring the catch-all masquerading rule - I'm not convinced that creating a SNAT will work.

    Other masquerading rules work as expected - i.e. SMTP traffic goes out on one of the static IP's and not the DHCP address.
  • 0
    Could you please post a screenshot of your MASQ and NAT rules.  Do keep in mind that higher ordered MASQ or NAT rules will take precedence (1 has the highest precedence, then 2, then 3, etc.).
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    Scott's right.  In a situation where you want specific traffic to leave via an Additiona Address, a SNAT is the right "trick" to use:

    External (Address) -> Web Surfing -> Internet : SNAT from External [Other Address] (Address)


    Note that the service stays blank and that the address objects are those created by WebAdmin.

    Cheers - bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Scott's right.  In a situation where you want specific traffic to leave via an Additiona Address, a SNAT is the right "trick" to use:

    External (Address) -> Web Surfing -> Internet : SNAT from External [Other Address] (Address)


    Note that the service stays blank and that the address objects are those created by WebAdmin.

    Cheers - bob



    Thanks for the feedback Bob.  I made the change Scott suggested using your additional information and it works.

    Many thanks to you both and sorry for doubting you Scott [:D]
  • 0 in reply to andrew.matthews
    Hi all.

    i realise this is a very old thread but I'm trying through sheer desperation!

    I am in the exact same boat - BT Business, DHCP IP on interface with 5 additional Stactic IPs.

    This solution is not working for me! I have created an SNAT rule and also a Masquerading rule to send traffic via one of the additional IPs, but they only work when the proxies are turned off!

    If Web Filtering is on, then all HTTP traffic leaves on the default IP assigned by DHCP. If I relay mail through the UTM, then that also leaves on the default IP, which is no good because the mail gets bounced back from most servers!

    As soon as I turn off Web Filtering and tell Exchange to route mail directly rather than relay through the UTM, then they follow the masquerading/SNAT rules and leave on the correct IPs!

    How do I stop this! This is baffling as these should be simple features that aren't implemented for some reason! I would appreciate any advice if someone can give any!!

    Using Sophos UTM 9.309-3

    Thanks in advance
  • 0 in reply to axis-frank

    It is still a problem!

    We have the same issue here and no solution yet - we can only decide, wether we'd like to use Web filtering or sending the traffic out via the correct interface.

     

    The thing with SNAT is, we can NOT differentiate between any user groups - only send the whole Web traffic out on another interface.

    Hasn't anyone found a solution yet?

  • 0 in reply to Daniel Karas

    Hi, Daniel, and welcome to the UTM Community!

    This has long been a feature requested by UTM users.  You may want to vote for and comment on Proxies and Profiles Mapping to Additional Addresses.  My comment there suggests a workaround that can be done with a second proxy.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML