We're running Sophos UTM 9.x in AWS and enabled Proxy Protocol support in the WAF. We've also enabled proxy protocol support in the HAproxy instances sitting in front of the UTM. We can see the source IP addresses in the WAF log but not in the Firewall log. We were expecting the source IP address would also be visible in the Firewall log since we have already enabled proxy protocol support. What steps are we missing? Thank you.
Hi Bob, thanks for this! Since Sophos is behind an HAProxy instance, would the DNAT rule work? I tested by creating this DNAT rule:
In the network group "Malicious IPs," I added the public IP address of my current connection and in the target destination, the /16 network where the target instances are. I did a test cURL to the public endpoint, which passes through the WAF (and supposedly the DNAT) and the connection still works. What am I doing wrong?
Hi Bob, thanks for your time. The reason why I added the public IP of my current connection to the "Malicious IPs" group is for testing the DNAT rule. Anyways, I found a resource I can do the tests from and have removed the public IP of my current connection from the "Malicious IPs" group.
I changed the NAT rule and changed the "Going to:" box with a group (which contains the network where the target instances are). However, the result is still the same -- I can still access the endpoint from my test connection. Is it because Sophos is sitting in front of an HAProxy instance? Proxy protocol doesn't seem to have an effect in the DNAT rule.
[test instance] --> [haproxy] --> [sophos] --> [internal network]
Hi Bob, here you go
