Deploying Sophos Firewall on Hetzner Cloud: A Step-by-Step Guide

Introduction

Hetzner Cloud doesn't officially support Sophos Firewall. You can still run it there reliably, and the installation itself is the easy part. The hard part is that Sophos expects a classic network with a gateway on the same subnet, while Hetzner Cloud routes every server through a fixed gateway outside it.

After several failed attempts, I ended up with a setup that:

• keeps WAN connectivity stable,
• keeps the Admin Web GUI reachable,
• survives reboots with no manual fixes.

This guide walks through that exact setup, including why each step is needed.

Who this is for: system and network administrators who are comfortable with basic routing and a Linux shell.

What breaks, and why

A default install on Hetzner Cloud runs into three problems:

1. The Admin Web GUI is unreachable after installation. Sophos boots, but there is no route out, so you can't reach the GUI.
2. The LAN interface doesn't come up. Port2 can stay down, so the private network doesn't work.
3. Every reboot undoes manual fixes. Routes you add by hand disappear, and the GUI goes offline again.

A working setup has to solve all three together: routing, interface activation and persistence after reboot.

How the network looks

All IP addresses below are examples, except the Hetzner gateway 172.31.1.1, which is the same on every Hetzner Cloud server.

Hetzner networking

• Public network: the upstream gateway is always 172.31.1.1. You can't change it.
• Private network: for example 10.20.20.0/24.

Sophos interface mapping

Sophos interface	Role	Network
Port1	WAN	Hetzner public network
Port2	LAN	Hetzner private network

Step 1: Create the server and install Sophos

1. Upload the Sophos Firewall ISO to Hetzner Cloud.
2. Create a new server from the uploaded ISO.
3. Attach a private network (for example 10.20.20.0/24).
4. Install Sophos Firewall as usual.

The installation succeeds, but networking doesn't work yet. That's expected.

Step 2: Configure the interfaces from the console

On first boot, from the Sophos console:

• Give Port1 a static IP: the public IP of your Hetzner server, with netmask /24.
• Leave Port2 unconfigured for now.

Don't try to open the GUI yet.

Step 3: Add temporary routes to reach the GUI

Open Advanced Shell from the Sophos console and run:

ip route add 172.31.1.1 dev Port1
ip route add default via 172.31.1.1 dev Port1
ifconfig Port2 up

This restores outbound connectivity and access to the Admin Web GUI at:

https://your-public-ip:4444

Heads-up: these routes are not persistent. Any reboot breaks connectivity again until you finish Step 5.

Step 4: Run the setup wizard and register in Sophos Central

1. Complete the Sophos initial setup wizard.
2. Register the firewall in Sophos Central.
3. Set Port1 to zone WAN with IP assignment DHCP.

Applying these changes reinitialises the interfaces, so routing breaks again. Run the three commands from Step 3 once more to get back in.

Step 5: Make routing permanent

To keep routing after a reboot, add these static routes in Sophos:

Destination	Gateway	Interface
172.31.1.1/32	—	Port1
0.0.0.0/0	172.31.1.1	Port1

The first route makes the Hetzner gateway reachable on Port1. The second sends all other traffic through it. Together they keep the default route in place after every reboot.

Step 6: Configure the LAN interface

Set up Port2 as LAN:

• Static IP, for example 10.20.20.2/30
• Zone: LAN
• Connected to the Hetzner private network

Routing is now persistent and the WAN is stable.

Step 7: Bring Port2 up automatically after reboot

On some installs, Port2 still doesn't come up by itself after a reboot. A small startup script fixes that. Run the following from Advanced Shell.

Make the filesystem writable

mount -no remount,rw /

Create the startup script

vi /scripts/system/clientpref/customization_application_startup.sh

Add these lines:

#!/bin/sh
sleep 15
ifconfig Port2 up
exit 0

Set permissions and lock the filesystem again

chmod +x /scripts/system/clientpref/customization_application_startup.sh
mount -no remount,ro /

Port2 now comes up on every boot without manual work.

The result

• Stable WAN connectivity
• A working LAN over the Hetzner private network
• Routing that survives reboots
• Interfaces that come up on their own
• Full management through Sophos Central

I've tested this setup across multiple reboots, and it stays stable.