Using a Sophos UTM in Virtual Box

Sophos provides a free home user UTM.  This is a direct update to the older Astaro ASG that I was running.  I recently had to convert over to the new system.  I run it on my FreeBSd server so prefer to use Virual Box to run my VM's.  I ran into a bit of an issue getting the UTM onto the network, but now it's working perfectly.  Here are some simple instructions to get it working.

First of all register and download the VMware x86 or x64 zip file(not the ESX version).  Onew downloaded unzip this file and grab all the *.vmdk files.  The other files can be discarded.

Now go into Virtual box and create a new VM.  Select Linux as  the OS and configure it as desired with the following changes.

• Add a new IDE disk and browser for and select the base VMDK file. (The one without a -s###.)
• Add two network cards and change both to use Bridged Networking and change the device driver to Intel PRO/1000 MT Server.

This should be all that is needed to get things working, though I would suggest removing the audio hardware.  Also the UTM shouldn't need much memory, 350-500MB depending on the features you plan to enable.

Now you can boot up the VM.  If you plan to run it as a service you can but for now you need to start it directly in VirtualBox so you can get at the console. Once booted up the system will list and IP to access it at but this won't actually work due to our VM/Nic setup.  So instead go into the UTM's console and logging as root.  The password will be blank and you will need to change it.

Now on the UTM do the following to reconfigure the default network settings. Tab completion will work here.  Also be sure to substitute you settings for the following variables:
$ADDRESS (eg: 192.168.1.5) Internal Ip for the UTM.
$NETMASK (eg: 24) See here for help.
$BROADCAST (eg: 192.168.1.255) Subnet part of Ip filled in with 255 for the rest.
$NETWORK (eg: 192.168.1.0) Subnet of the Ip filled in with 0's.
$INTERFACE Use tab compleation for this and choose witch NIC you want as your internal.

cc
RAW
lock_override
OBJS

itfparams
primary
REF_ItfParamsDefaultInternal
address=$ADDRESS
netmask=$NETMASK
w
/

network
interface_address
REF_DefaultInternalAddress
address=$ADDRESS
w
/

network
interface_broadcast
REF_DefaultInternalBroadcast
address=$BROADCAST
w
/

network
interface_network
REF_DefaultInternalNetwork
address=$NETWORK
netmask=$NETMASK
w
/

interface
ethernet
REF_DefaultInternal
itfhw=REF_ItfEth$INTERFACE
status=1
w

exit

Each set of commands above will print out the new config when the w line is entered so you should be able to identify any errors or problems.  Once finished you can reboot the UTM by typing reboot.

Now if everything is working you should be able to navigate to https://$ADDRESS:4444 and setup the UTM. If you get any error about not being able to change your active connection then one of the settings above must not match or the the itfhw in the last step didn't get set right.

My new Network Layout with Astaro

So I being a Comcast customer, not by choice, decided I wanted to be able to more closely monitor and control my network usage. I was toying around with different ways to monitor my traffic but didn't want to replace my router not add another device to the network outside the router.

I also looked at monitoring traffic per device, but this has its own problems such as missing traffic and counting local traffic twice, once on the source and again on the destination. The long an the short is I can only do what I want by having the traffic bass through a single device, an Astaro Security Gateway in my case.

I do run VMware Server on my single server though and desided if I could get a configuration with the ASG running in a virtual machine thus not needing the extra hardware. While, after a few hours of testing, and restoring my router once, I got it up and working. Heere is a diagram of the layout and soem notes.

Black lines on white are pyisical network connections.
Black lines on blue are vmware bridge connections.
Green lines indicate internal network traffic.
Red lines indicate external network traffic.

Some variouse notes on my configuration:

• The monitored internal netowrk is on the 192.168.1.* subnet.
• The unmonitored external network is on the 192.168.1.150.* subnet.
• Both networks exist on the same pyisical switch but the DHCP server doles out only internal addresses. A computer could be configured staticly to the external subnet and I havn't found a way to prevent this but in oder to circumvent the ASG the user would have to know about the second subnet.
  
• The server has only a single gigabit network interface card on it. Traffic on the internal network heading out will go to the server and be passed onto the ASG's internal virtual interface. Next the ASG will proccess the traffic and send it back out on the external interface. The server will pass the traffic back out on its internal interface but the traffic will really be on the external subnet so it will pass off to the router.
• The internal and external networks co-exist on the same network segment just differnet segments, for that reson I pourpasly left on the main routers Firewall and NAT.
• There is no noticible impact on network preformance as the traffic is already limited by teh 6M cable modem connection.
• I can not monitor just the external interface of teh ASG for trafic usage statistics with vnstat.