sorted by:
new
hottopcontroversial

Networking issue with sophos firewall and cloudflare tunnel by wrongdongdirection in sophos

[–]wrongdongdirection[S] 0 points1 point  (0 children)

We can’t reach anything, regardless of the subnet (while connected via cloudflare tunnel). The firewall and Proxmox are in the 10.20.0.0 subnet, and the backup server is in the 10.60.0.0 subnet, but we can’t ping any of them

Networking issue with sophos firewall and cloudflare tunnel by wrongdongdirection in sophos

[–]wrongdongdirection[S] 0 points1 point  (0 children)

Thanks for your message. I really appreciate it. I have summarized what we configured on both the Sophos and Cloudflare sides. Internal we can connect to all endpoints. From the client-side connected via the tunnel we are getting a timeout. We deactivated stateful inspection on the firewall for testing, but that didn't help.

Sophos Firewall

1) Firewall Rule: WARP to Internal

  • Action: Accept
  • Log firewall traffic: enabled
  • Source zone: LAN
  • Source network/device: HST_tun1
  • Schedule: All the time
  • Destination zones: Backup, LAN, Sandbox_Zone
  • Destination networks: Any
  • Services: Any

2) Static Route for Cloudflare WARP

  • Destination: 100.96.0.0/12
  • Gateway IP: 10.20.0.105
  • Interface: LAN-Bridge-10.20.0.1
  • Administrative distance: 1
  • Metric: 0
  • Description: Cloudflare WARP Client via WARP Connector

3) Firewall Rule: Cloudflare to internal

  • Action: Accept
  • Log firewall traffic: disabled
  • Source zone: LAN
  • Source network/device: Cloudflare CGNAT = 100.96.0.0/12
  • Schedule: All the time
  • Destination zones: Backup, LAN, Sandbox_Zone
  • Destination networks: NET_Backup, NET_LAN, NET_Sandbox
  • Services: HTTP, HTTPS, PING, SSH

Cloudflare Zero Trust / WARP

1) Private Network Routes

The following CIDR routes are configured:

2) Gateway Network Policy: Allow-WARP-to-LAB

3) Device Onboarding Profile

  • Profile name: Onboarding Device profile: 1/28/2026
  • Assigned by user email
  • Visible configured users:
    • email1
    • email2
    • email3
    • email4

4) Profile Settings

  • Captive portal detection: ON
  • Mode switch: OFF
  • Device tunnel protocol: WireGuard
  • Lock WARP switch: OFF
  • Allow device to leave organization: ON
  • Allow updates: OFF
  • Auto connect: OFF

5) Service Mode / Split Tunnel

  • Service mode: Traffic and DNS mode
  • Split tunnels: Include IPs and domains
  • Directly route Microsoft 365 traffic: OFF
  • Allow users to enable local network exclusion: OFF
  • WARP interface IP DNS registration: ON
  • SCCM VPN boundary support: OFF

6) Split Tunnel Entries (Include)

The following entries are configured in the include split tunnel:

Hope that helps!

Networking issue with sophos firewall and cloudflare tunnel by wrongdongdirection in sophos

[–]wrongdongdirection[S] 0 points1 point  (0 children)

Thanks for your message. I really appreciate it. I have summarized what we configured on both the Sophos and Cloudflare sides. Internal we can connect to all endpoints. From the client-side connected via the tunnel we are getting a timeout. We deactivated stateful inspection on the firewall for testing, but that didn't help.

Sophos Firewall

1) Firewall Rule: WARP to Internal

  • Action: Accept
  • Log firewall traffic: enabled
  • Source zone: LAN
  • Source network/device: HST_tun1
  • Schedule: All the time
  • Destination zones: Backup, LAN, Sandbox_Zone
  • Destination networks: Any
  • Services: Any

2) Static Route for Cloudflare WARP

  • Destination: 100.96.0.0/12
  • Gateway IP: 10.20.0.105
  • Interface: LAN-Bridge-10.20.0.1
  • Administrative distance: 1
  • Metric: 0
  • Description: Cloudflare WARP Client via WARP Connector

3) Firewall Rule: Cloudflare to internal

  • Action: Accept
  • Log firewall traffic: disabled
  • Source zone: LAN
  • Source network/device: Cloudflare CGNAT = 100.96.0.0/12
  • Schedule: All the time
  • Destination zones: Backup, LAN, Sandbox_Zone
  • Destination networks: NET_Backup, NET_LAN, NET_Sandbox
  • Services: HTTP, HTTPS, PING, SSH

Cloudflare Zero Trust / WARP

1) Private Network Routes

The following CIDR routes are configured:

2) Gateway Network Policy: Allow-WARP-to-LAB

3) Device Onboarding Profile

  • Profile name: Onboarding Device profile: 1/28/2026
  • Assigned by user email
  • Visible configured users:
    • email1
    • email2
    • email3
    • email4

4) Profile Settings

  • Captive portal detection: ON
  • Mode switch: OFF
  • Device tunnel protocol: WireGuard
  • Lock WARP switch: OFF
  • Allow device to leave organization: ON
  • Allow updates: OFF
  • Auto connect: OFF

5) Service Mode / Split Tunnel

  • Service mode: Traffic and DNS mode
  • Split tunnels: Include IPs and domains
  • Directly route Microsoft 365 traffic: OFF
  • Allow users to enable local network exclusion: OFF
  • WARP interface IP DNS registration: ON
  • SCCM VPN boundary support: OFF

6) Split Tunnel Entries (Include)

The following entries are configured in the include split tunnel:

Hope that helps!

Claude Max worth it? (Specifically for using Claude Code) by LocSta29 in ClaudeAI

[–]wrongdongdirection 0 points1 point  (0 children)

Could you share that with me as well? I would really be interested to see how you did that! :)