Https Web Access on Additional Interface

Hi Darren,

could you please provide some Screenshots of the following configuration:

QoS (if activated)

NAT Rules

Interface Configuration

I would guess a problem with the NAT rule, but to analyse the problem these screenshots would really help :)

Greetings

Ole

Hi Ole,

Thanks for getting back to me, like you I think its the NAT rule as http works fine on the Additional Interface as there is a DNAT rule setup for that.

I have attached the images as requested, for security reasons I have removed the IP address but can confirm this is correct as the http rule works. Qos not enabled.

Regards,

Darren

Hi Ole,

Thanks for getting back to me, like you I think its the NAT rule as http works fine on the Additional Interface as there is a DNAT rule setup for that.

I have attached the images as requested, for security reasons I have removed the IP address but can confirm this is correct as the http rule works. Qos not enabled.

Regards,

Darren

Hi,

So far the configuraton seems right. One thing I would recommend changing is the point "For traffic from:" in your NAT-rule. Here it would be better to put the definition "Internet IPv4" to exclude your local addresses from accessing the NAT-rule.

Furthermore you could try changing the WebAdmin Port. It seems like it is currently set at Port 443 (standard https). Please try changing it to something else like 4444 or 10141 for example.

You can do this by going into "Management" -> "WebAdmin settings" -> "Advanced" -> "WebAdmin TCP Port"

Please let me know if this was helpful!

Regards,

Ole

Ok strange one, I can now get past the Sophos UTM device by changing the port number on the remote site for HTTPS access, but I still cannot get through to the site. I get page cannot be displayed. I have opened the port in the firewall but to no avail.

Any help would be appreciated.

Darren

Can you please check the configuration of your webserver?

Check its gateway and if you can maybe log some traffic (for example with wireshark)

I did not really understand this statement:

"I can now get past the Sophos UTM device by changing the port number on the remote site for HTTPS access"

what do you mean by that?

Hmm this really seems like a strange problem...[*-)]

Normally, WebAdmin is on TCP 4444, and that should not conflict with an HTTP access on TCP 443, so I would not suggest changing from 4444.

If you were hitting anything, it would have been the User portal as the default for that is TCP 443.  That would indicate to me that your DNAT wasn't working because #2 in Rulz clearly states that DNATs are considered before everything else.  In addition to Ole's suggestion to replace "Any" with the "Internet IPv4" object, change the Additional Address from /28 to /32.

If that doesn't resolve your problem, check #3 in Rulz.

Any luck yet?

Cheers - Bob