NAT Rule

[lmrogers]

I have just setup a DNAT rule on an XG running SFOS 18.0.4 MR-4. I created the rule using the Server Access Assistant. I can see traffic being allowed through on the firewall rule that was created but am unable to see the webserver that I have created the NAT for.

Not sure if there is something I'm missing.

NAT Rule:

Original Source: Any

SNAT: Original

Original Destination: Public IP (Added as an alias on the WAN interface)

DNAT Webserver internal address

Original Services: HTTPS

PAT: Original

Firewall Rule:

Source Zone: Any

Source Network: Any

Destination Zone: LAN

Destination Network: Webserver internal IP

Services HTTPS

Is there anything in this that is wrong?

[Wave9_Tim]

The NAT statement looks fine, though the firewall rule needs the public IP address of the webserver rather than the internal IP.

 

Regards

[lmrogers]

Thanks, I corrected that and still have the same issue of not being able to access it. I can see in the log viewer that the firewall is allowing the traffic through to the public IP.

 

Feel like I'm missing something really obvious.

[Davit2005]

Thanks, I corrected that and still have the same issue of not being able to access it. I can see in the log viewer that the firewall is allowing the traffic through to the public IP.

 

Feel like I'm missing something really obvious.

 

Does the Sophos have any sort of packet capture facility

 

I assume you have dealt with the local firewall on the web server and the web server is configured and able to serve out the web pages on https OK?

 

Additionally I'd be inclined to have the NAT rule as any service if this public IP address is only used for one externally available service.

Edited April 8, 2021 by Davit2005

[Wave9_Tim]

If you were using the interface IP address and not an alias I'd suspect the user portal was getting in the way.

 

A couple of things, as suggested you can run tcpdump from the CLI and see if the traffic passes through the XG to the local IP address (a simple tcpdump host will do, that will show the incoming traffic to the external NAT and the internal traffic leaving the inside interface). You can run that from the Diags > Packet capture tab too (I just prefer the CLI).

 

You can (also from the CLI) run conntrack -L -s -d to see which NAT and firewall rule you hit - 0's show it's hitting system rule.

 

Regards

[lmrogers]

Cheers for the help guys. Found the problem, I was being stupid. Should just stop working late at night.