Hi All,

I am new to Astaro Security Gateway. I am trying to learn the device in a rush. I am currently running an ASG220 v6.203. The device already had the internal network (on eth0) configured. I added a second network called EXTERNAL (on eth1), and a third called DMZ (on eth2).

I activated EXTERNAL and was able to perform UP2DATE updates to bring the device from version 6.200 to 6.203. I can ping from the device to the Internet. I can ping the IP of eth1 from a PC on a switch connected to eth0. What I can't seem to do is get any traffic from the INTERNAL network to the EXTERNAL network.

In otherwords, I can't browse the Internet from my INTERNAL network. According to the manual for the ASG220, static routing for internal interfaces is configured by the software automatically. This seems to have worked.

Am I missing something? Did I set something up wrong? Any help would be greatly appreciated.

Thank you,

Ken

You need to setup some PacketFilter rules to allow outgoing traffic.
Default is DENY.

Also, you may need to setup NAT/Masq.

This is covered in the manual; also there is a "getting started guide" and other documents at http://www.astaro.com/support/documents_resources

Barry

__________________
http://DealBert.net
Home & business end-user since v1.x

• ASL 6.3x, HP DL145 Dual Opteron, 1GB RAM, 6 gigE NICs, 50-IP Platinum License
  
• ASL 7.5x, HP DL360G5, Xeon 5160, 3GB, RAID, gigE NICs, 50-IP Platinum License
  
• ASL 7.5x, 17-watt fanless mini-ITX system: MSI IM-945GSE-A Atom n270, 2GB RAM, Morex T3310 case. 2 Intel GigE, 3 VLANs. 80G 5200rpm 2.5" HD
  Netgear GS108T gigE VLAN switch & Linksys WRT54G WAP
  Total network infrastructure: 27 watts. 100-IP Home User. FiOS 10mb/2mb

Hi Barry,

I added a packet filter rule to the system, however, the rule doesn't appear to work. I added a rule stating that a single host (defined in DEFINITIONS-->NETWORKS) Allow ANY to my EXTERNAL(network). I then try to access anything from that host and the log shows the packets being dropped.

Any ideas?

- Ken

PS - I already read the quickstart guides. I will look over it again. Thank you for the tip!

The definition should be: Internal host (or network) -> ANY (not "External" network) with whatever services you want (any is fine, but a more granular approach is better). Also, if you want to take advantage of the Web Protection license (I'm assuming you have this, most of our customers buy it) which enables AV scanning and content filtering of HTTP traffic, you'll want to use the HTTP Proxy to take advantage of that.

Oh, and if you haven't done it already.. you need a NAT MASQ rule setup.. Internal Network -> MASQ -> External Astaro Address.

Hi Guys,

Thank you much, I was able to get my browsing up and running. Now off to other configuration.

Thanks again!

- Ken

So what was missing?

I didn't understand how Astaro's ASG handled masquerading versus routing. The method works different than other devices I have played with in the past. All I needed to do was properly set the masquerade settings and BAM, I was on the internet.

Thanks for the help all!

I'm having the same issue.. How do you have Masq setup now?

I use http proxy WITHOUT any nat/masquerading set up and it just works!