Sophos XG Home brings down network in bridge mode

[Theldron]

Hi all,

 

Following this guide https://www.linkedin.com/pulse/configuring-sophos-xg-firewall-vmware-esxi-kelvin-charles/?trk=pulse_spock-articles I have been setting up Sophos XG for my home.

 

When it give me choices what I want to enable, e.g. stop malware, dangerous websites, etc. I select them then click save, then the whole network crashes. I get serious complaints from my family.

 

I want to setup the network as: Plusnet Router ------> Sophos XG ------> Switch -------> Wifi

i

wired Devices

 

At the moment I have a cable going from the router directly to the switch until I had Sophos setup properly.

 

But when I click save everything goes down.

 

Cheers

[Theldron]

Ahhhhhhhhhh!!!!!! Tried this in gateway yesterday and I couldn't get any Internet connection.

 

Followed this advice:

 

You will have WAN and LAN zone interfaces. So basically one interface defined as WAN, which uses the connection to the router. In the router should be only one interface (XG). This Interface will be setup as DHCP Client.

 

The other interface is defined as LAN and runs an own DHCP Server. This LAN interface works as a gateway for all clients. It provides DNS, DHCP etc.

 

You should start with a simple LAN to WAN Rule with MASQ enabled.

 

This should work in the first setup. Afterwards you can play with all the security features in the firewall rule and see, what happens.

 

But this should work for every connection fine.

 

Still couldn't get it to work. Should I be using it bridge or gateway mode? Do i need to setup DHCP etc on Sophos or can I allow it on the router?

 

I am tempted to try Untangle, PFSense or OPNSense if I can't get this working, as I am pulling my hair out.

 

Wanted to use Sophos as we use it as one of the schools I work at and thought I could get a firewall for home and learn how to use it, at the same time. Though it does seem like they have taken the business setup and just said its an home edition.

[computer_expert]

The older Sophos UTM (and also pfSense) does work in a double NAT configuration as I used it like this at one point.

 

Set the plusnet router up in router mode (not bridge/passthrough), then set the WAN interface on the sophos box to DHCP (to grab an address from the plusnet router). Use a separate ip range for the sophos LAN interface.

 

For example in gateway mode:

plusnet router - 192.168.1.254/24
\/
ethernet cable
\/
Sophos WAN - gets an IP from the 192.168.1.0/24 range
Sophos LAN - 192.168.50.254
\/
ethernet cable to switch
\/ 
Clients in the Sophos LAN - something from the 192.168.50.0/24 range via DHCP from the sophos box

 

This should get you started. Once you feel confident I'd move sophos onto it's own box and look at either putting the plusnet into modem only mode or ditching it completely.

 

Also be aware that if you take the ESXi host offline (e.g. patching/rebooting) you will lose all internet connectivity. For this reason I'd suggest putting it on it's own dedicated box.

 

edit - for the sophos setup, connect the machine you are using to the sophos LAN port rather than trying to do it over the WAN port

Edited November 26, 2018 by computer_expert