topic Re: Natting Proxy-Traffic to internal IP in Firewall and Security Management

Natting Proxy-Traffic to internal IP

Andre91 — Thu, 27 Oct 2022 11:28:12 GMT

Hello,

we have the following problem, regarding HTTP-/HTTPS-Proxy on our CheckPoint ClusterXL R81.10:

The cluster is configured as a non-transparent http/https-proxy on one cluster-vip-ip port 8080. We even host some websites on internal webservers, that are available via a external NAT on the cluster-xl, redirecting to internal webservers / reverse proxies:

External Client -----> www -----> public Cluster-IP -----> NAT to Webserver -----> Webserver

Now when our internal clients want to view a webpage, that is hosted on our internal servers, the page is not available.

So the process is:

1. Client resolves the dns-name of the webpage to the public ip.

2. Client opens a proxy-session with the checkpoint-cluster

At this point we want to have a NAT-Rule that redirects traffic, originally sent to our public Cluster-IP (original Dst) to our internal Webserver (translated Dst).

The standard NAT-Rule doesn´t work:

Internal Clients -----> public Cluster-IP:https -----> Original Src. -----> Internal Webserver

Is there a trick, so we can redirect http-/https-proxy-traffic to an internal server?

Thanks and best regards

Re: Natting Proxy-Traffic to internal IP

Chris_Atkinson — Thu, 27 Oct 2022 15:31:03 GMT

Do you use WPAD / PAC file for your proxy configuration and are local domains excluded ?

Re: Natting Proxy-Traffic to internal IP

PhoneBoy — Fri, 28 Oct 2022 14:52:52 GMT

I am assuming both the internal clients and your webserver are accessible through the same physical interface.
That means you basically need a hairpin NAT rule, something similar to what I described here: https://community.checkpoint.com/t5/Security-Gateways/Traffic-flow-in-between-C-to-S-via-Firewall-How/m-p/8465/thread-id/13081#M13082

Re: Natting Proxy-Traffic to internal IP

Andre91 — Mon, 28 Nov 2022 11:34:27 GMT

Thanks for the tips, we excluded our domain-names in our PAC file. That works so far