#SOPHOS LOOPBACK NAT HOW TO#

If you configure a public interface as a bridge member, source NAT rules using the interface are deleted. You can’t create a SNAT rule using a public interface that’s a bridge member because bridge members don’t belong to a zone. You can also define interface-specific NAT to translate the IP addresses of one or more internal hosts to the IP address you specify for an outbound interface. It doesn't perform one-to-one translation even if the number of IP addresses in the range is the same for the original and translated sources. If you configure an IP address range as the translated source, Sophos Firewall assigns the next available IP address in the range. For the destination zone, it uses the zone to which the translated (post-NAT) destination belongs. It then matches the firewall rule based on the source and destination zones, source and destination networks, services, and schedule. Incoming traffic: Sophos Firewall looks up the DNAT rule first to determine the translated (post-NAT) destination.

Outgoing traffic: Sophos Firewall applies the firewall rule first and then the SNAT rule.

The order in which Sophos Firewall looks up and applies NAT and firewall rules is as follows: If it doesn't find a matching NAT rule, it allows the traffic to flow but doesn't translate the IP address.įor NAT rules, the matching criteria are the original (pre-NAT) source, destination, and service, and the inbound and outbound interfaces. If Sophos Firewall doesn't find a firewall rule that matches the traffic criteria, it drops the traffic and logs the event. So, you must create firewall rules even if you have created NAT rules. NAT rules translate IP addresses for traffic the firewall rule allows. This setting is useful when troubleshooting.įirewall rules allow or drop traffic entering and exiting the network.

To reset the number of times a rule was in use, select Reset usage count.

To unlink a rule from the firewall rule, select Unlink rule.

To add a rule next to an existing rule, select the action.

To edit or delete a rule, select the action.

To turn on or turn off a rule, select the switch.

So, position the specific rules above the less specific rules.Ĭlick More options to specify the following actions: Once it finds a match for the packet, it doesn’t evaluate subsequent rules. Sophos Firewall evaluates rules from the top down until it finds a match.

To change the sequence of a rule, click and drag the Rule handle.

To delete rules, select the rules and then select Delete.

To turn off rules, select the rules and then select Disable.

To reset the rule filter, select Reset filter.

To hide or show the rule filter, select Disable filter and Enable filter respectively.

To see IPv4 or IPv6 rules in the rule table, select IPv4 or IPv6.

The assistant also creates a reflexive SNAT rule (for outbound traffic from the servers), a loopback rule (for internal users accessing the servers), and a firewall rule (to allow inbound traffic to the servers) automatically. Use Server access assistant to create DNAT rules to translate incoming traffic to servers, such as web, mail, SSH, or other servers, and to access remote desktops.

To create destination NAT rules and the related firewall rules automatically, select Add NAT rule and then select Server access assistant (DNAT).

To add a NAT rule manually, select Add NAT rule and then select New NAT rule.

#SOPHOS LOOPBACK NAT HOW TO#

For details, see How to apply NAT over a Site-to-Site IPsec VPN connection. To allow traffic flow between overlapping local subnets, you must configure NAT over policy-based IPsec VPN on VPN > IPsec connections. Sophos Firewall automatically adds a linked NAT rule to match traffic for email MTA mode. Linked NAT rules are SNAT rules and are created from firewall rules.

Changing or deleting the original NAT rule doesn’t affect them. These rules remain independent of the original rule from which they’ve been created. You can specify loopback and reflexive rules for a destination NAT rule. You can create NAT rules for IPv4 and IPv6 networks. You can create source NAT (SNAT) and destination NAT (DNAT) rules to enable traffic flow between private and public networks by translating non-routable, private IP addresses to routable, public IP addresses.

It translates private IP addresses into public IP addresses, allowing private IP networks to connect to the internet and hiding the internal network behind the public IP address. Network Address Translation (NAT) allows you to translate IP addresses and ports for traffic flowing between networks. Your browser doesn’t support copying the link to the clipboard. It will remain unchanged in future help versions. Always use the following when referencing this page.

Sophos loopback nat