2

I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is plugged directly into the Sonicwall). NAS should have free access to LAN and vice versa, but NAS should have no access to or from the WAN.

In the firewall interface, I can see that the NAS has been assigned an IP address of 192.168.20.99. From a machine on LAN at 192.168.10.99: I can ping 127.0.0.1, 192.168.10.99, and 192.168.10.1. But from 192.168.10.99: I cannot ping 192.168.20.1 or access the NAS at 192.168.20.99.

By request, the configuration file is attached here. (It is too large to include in the body.)

NAS is in its own newly created zone on X2. The following access rules are in place for v4 and v6:

NAS <> LAN, any source/destination/service: allow
NAS > NAS, any source/destination/service: allow
NAS <> WAN, any source/destination/service: deny
NAS <> WLAN, any source/destination/service: deny
NAS > DMZ, any source/destination/service: allow
NAS < DMZ, any source/destination/service: deny
v4 only: NAS > NAS, any source, all X2 management IP, ping/HTTPS mgt/HTTP mgt: allow

The following NAT policies (created by Sonicwall when I set up the zone) are in place for v4 on X2:

enter image description here

The following address objects (also created by Sonicwall) are in place for v4 on X2. Both have zone = NAS and class = default. (There are also some v6 objects.)

v4: X2 IP, details 192.168.20.1/255.255.255.255, type = host
v4: X2 Subnet, details 192.168.20.0/255.255.255.0, type = network

Similar objects for the LAN do exist. I still can't ping 192.168.20.1 from a machine on 192.168.10.99, but I can ping NAS at 192.168.20.99. I cannot access the NAS drive any other way, but it is now answering pings. So I am guessing that the problem is not with the firewall.

4
  • Question edited. Configuration file attached. At ~500k, it is too large to include in the question body. Thank you.
    – Bolio
    May 2 at 19:25
  • 2
    You will need to create firewall rules (no NAT is required). You'll probably want X2 in a separate Zone (DMZ would be fine) and then create FW Rules to allow traffic to/from LAN and DMZ, and uncheck/disable the rule from DMZ to WAN (which probably exists by default). Create an Address Object for the NAS (you can set a DHCP reservation as well) then you can use it in your Rules (an Object for LAN Network should exist). See examples here: sonicwall.com/support/knowledge-base/…
    – PSaul
    May 4 at 1:47
  • Thanks @PSaul. Added firewall rules and other info above. I can now ping the NAS, but cannot access it any other way. Guessing that there is something going on with the NAS itself.
    – Bolio
    May 6 at 12:26
  • You probably can't ping 20.1 since that would require some loopback NAT or other hairpin rule (since 20.1 is the router, just an interface on a different subnet, and 20.99 has its own interface on its own subnet to the same device). If you can't connect except by PING I would try 1) ensure you CAN connect to the NAS when on the same subnet, and 2) ensure the NAS has the correct default gateway and other on-NAS settings. You may find it easier to set up allowed access first, confirm it is working, and then lock it down. (eg. allow the NAS to access the WAN, many have consoles to test with)
    – PSaul
    May 6 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.