Introduction

Running Sophos Firewall on Hetzner Cloud is not officially supported.
However, with the correct routing and interface configuration, a stable and reboot-safe deployment is absolutely achievable.

The main challenge is not the Sophos installation itself, but how Sophos expects networking to behave versus how Hetzner Cloud actually implements routing and gateways.

After multiple iterations and failed attempts, I was able to reach a setup that:

• Provides stable WAN connectivity

• Keeps the Admin Web GUI accessible

• Survives reboots without manual intervention

This article documents the exact approach that worked, including the root causes and the required fixes.

⚠️ This guide is intended for system and network administrators with basic routing knowledge.

---

Problem Summary (What Breaks and Why)

The issues encountered fall into three main categories:

1. Admin Web GUI not accessible after installation

   • Sophos boots successfully, but no outbound routing exists.

   • Without manual routing, the GUI cannot be reached.

2. Interfaces not fully operational

   • LAN interface (Port2) may remain down.

   • Internal networking does not function as expected.

3. Loss of connectivity after reboot

   • Even if routing is temporarily fixed, rebooting the firewall:

     • Breaks routing again

     • Makes the Admin Web GUI unreachable

     • Requires manual recovery unless persistence is configured

A proper solution must address all three aspects together:
routing, interface activation, and reboot persistence.

---

Architecture Overview

💡 All IP addresses shown below are examples, except where explicitly stated.

Hetzner Networking Model

• Public Network

  • Upstream Gateway (fixed by Hetzner):

This gateway is always the same in Hetzner Cloud and cannot be changed.

Sophos Interface Mapping

Sophos Interface	Role	Network
Port1	WAN	Hetzner Public Network
Port2	LAN	Hetzner Private Network

---

Server & ISO Deployment

1. Upload the Sophos Firewall ISO to Hetzner Cloud

2. Create a new server using the uploaded ISO

3. Attach a private network (example: 10.20.20.0/24)

4. Complete the Sophos Firewall installation normally

At this stage:

• Installation succeeds

• Networking is not functional yet

This is expected.

---

Initial Interface Configuration (Console)

From the Sophos console during first boot:

• Assign Port1 a static public IP
  (use the IP assigned to your Hetzner server)

• Netmask: /24

• Leave Port2 unconfigured for now

Do not attempt to access the GUI yet.

---

Temporary Routing Fix (Initial Access)

Enter Advanced Shell from the Sophos console and apply:

This temporarily restores:

• Outbound connectivity

• Admin Web GUI access

You can now access the firewall GUI at:

⚠️ At this point, routing is not persistent.
Any reboot will break connectivity again.

Initial Wizard & Sophos Central Registration

1. Complete the Sophos initial setup wizard

2. Register the firewall in Sophos Central

3. Configure:

   • Port1

     • Zone: WAN

     • IP Assignment: DHCP

After applying these changes:

• Routing will break again

• This is expected due to interface reinitialization

Reapply the routing commands from the previous step to regain access.

---

Permanent Routing Configuration (Critical Step)

To make routing survive reboots, configure static routes in Sophos.

Static Routes on Port1

Add the following routes:

Destination	Gateway	Interface
172.31.1.1/32	—	Port1
0.0.0.0/0	172.31.1.1	Port1

This ensures:

• The Hetzner gateway is always reachable

• Default routing remains intact after reboot

---

LAN Interface Configuration (Port2)

Configure Port2 as LAN:

• Static IP (example):

At this stage:

• Routing is persistent

• WAN connectivity is stable

Ensuring LAN Interface Persistence After Reboot

In some cases, Port2 does not come up automatically after reboot.

To ensure persistence:

(From Advanced Shell)

Enable Write Access

Create Startup Script

Apply Permissions & Lock Filesystem

This guarantees:

• LAN interface activation after every reboot

• No manual intervention required

Final Result

After completing all steps:

• ✅ Stable WAN connectivity

• ✅ Functional LAN over Hetzner private network

• ✅ Reboot-safe routing

• ✅ Persistent interface state

• ✅ Full management via Sophos Central

The setup has been tested across multiple reboots and remains stable.