topic Re: Manual NAT with Port Forwarding on Check Point Virtual GW in Firewall and Security Management

Manual NAT with Port Forwarding on Check Point Virtual GW

WarrenJ1 — Wed, 15 Apr 2026 07:05:01 GMT

Hi Team,

We have configured the public IP segment 71.56.98.x/28 on the Check Point firewall WAN interface (eth1).

Our requirement is to perform manual NAT with port forwarding for one of our internal servers. We are using one available public IP from the above subnet and mapping it to the internal server 10.20.30.40, with the following requirement:

External Port: 443 Internal
Destination: 10.20.30.40:8443

However, we are facing the following issue:

When configuring Static NAT (manual NAT), the setup is not working
When using Automatic NAT, it is working, but we are unable to perform port forwarding (443 → 8443)

Could you please help us understand:

Why manual NAT is not working in this scenario
The correct way to configure port forwarding using manual NAT in Check Point

Kindly assist with the correct configuration or any prerequisites we may be missing.

Thanks & Regards,

Warren

Re: Manual NAT with Port Forwarding on Check Point Virtual GW

PhoneBoy — Wed, 15 Apr 2026 16:06:05 GMT

Automatic NAT will create the necessary proxy ARPs for NAT to work.
In manual NAT, you also have to configure a proxy ARP: https://support.checkpoint.com/results/sk/sk30197

Re: Manual NAT with Port Forwarding on Check Point Virtual GW

Martijn — Wed, 15 Apr 2026 16:57:56 GMT

Hi,

Can you show us the configured access rules and NAT rules you have configured for this traffic?

You mention NAT is working but unable to connect to the server. Is routing to the destination OK?
Maybe anti-spoofing on the internal interface for the return traffic?

What does the logs show?

Martijn

Re: Manual NAT with Port Forwarding on Check Point Virtual GW

Lesley — Wed, 15 Apr 2026 17:17:15 GMT

This is correct. Automatic NAT = you don't need to make proxy arp. With manual NAT you have to make proxy arp (unless you use IP that is configured on firewall interface). If you don't see the traffic in your traffic logs it is arp issue. You can confirm this by doing tcpdump on external interface. There you would see ARP request, who has IP XXX? And then no one will reply. With proxy arp the firewall reply and then the traffic will flow