topic Re: Make Windows Server accessible publically. in Firewall and Security Management

Make Windows Server accessible publically.

prashantds — Thu, 13 Feb 2020 13:32:25 GMT

Hi All,

I am very new to Checkpoint Firewall, We are using R77.30.

We want to make our server accessible publicly by using Public IP.This public IP is having GW different than the current one which is configured on fw for internet access.

I have tried making a Node with Static NAT, and allowed the traffic by making rules.

but when i use that internet stops working on the server. and its not working.

Please suggest.

Thanks,

Prashant.

Re: Make Windows Server accessible publically.

PhoneBoy — Fri, 14 Feb 2020 01:51:48 GMT

Screenshots of exactly what you configured along with a network diagram would help tremendously.

Re: Make Windows Server accessible publically.

prashantds — Fri, 14 Feb 2020 06:38:40 GMT

Hi,

Thanks for your reply. Please find attached config ss.

we have created one NAT rule hiding the server ip behind static public ip.

The problem is current public IP used for external traffic and the public ip we are going to use now have different GW.

Thanks,

Prashant.

Re: Make Windows Server accessible publically.

PhoneBoy — Fri, 14 Feb 2020 18:18:23 GMT

Please explain detail what you mean by "public ip we are going to use now have different GW."
A concrete example would help.

Re: Make Windows Server accessible publically.

prashantds — Sat, 15 Feb 2020 09:51:16 GMT

Hi,

Our current network runs on following Public IP range.

NW: xxx.xxx.23.88/29

GW xxx.xxx.23.89

The new ip we got from ISP is this :

NW: xxx.xxx.6.72
GW : xxx.xxx.6.73
MASK: 255.255.255.248

The IP for server which we want to access publicly is 10.38.28.19

My concern is how can i flow traffic from servers IP to xxx.xxx.6.72 IP and vice versa.

Thanks,

Re: Make Windows Server accessible publically.

Chris_Atkinson — Sat, 15 Feb 2020 12:40:20 GMT

What's the routing for the new network, where is the ISP routing it towards?

Re: Make Windows Server accessible publically.

mdjmcnally — Sat, 15 Feb 2020 19:58:39 GMT

In very simple terms what you want to do is have the ISP ROUTE your NEW IP Range to the Firewall on the Firewalls Current IP.

You can then create a Node for the Windows Server with the Private IP and then under Static NAT have the Public IP that want it known as.

At the moment when you do that then because the ISP Router has a Local Subnet for your Public IP then it does an ARP who has for the IP.

Nothing responds as doesn't exist and so you never get a reply.

If you provide the Check Point's External IP to your ISP and have them route the new Public IP Range to that IP then that will have the ISP Router forward all traffic for your new IP Range to the Check Point.

Re: Make Windows Server accessible publically.

prashantds — Sun, 16 Feb 2020 08:54:41 GMT

@mdjmcnally

Thanks for the explanation, is there no workaround for this to do it from myside??

Re: Make Windows Server accessible publically.

Chris_Atkinson — Sun, 16 Feb 2020 09:26:42 GMT

Unfortunately not unless you are using Dynamic routing with your ISP?

Correct routing is a prerequisite for NAT.

Re: Make Windows Server accessible publically.

prashantds — Sun, 16 Feb 2020 12:58:42 GMT

Ok... Thanks for replies guys...