topic NAT Question in Firewall and Security Management

NAT Question

JayM1 — Fri, 06 Dec 2024 15:05:45 GMT

I have a /29 public ip range provided by ISP. Unfortunately all public IPs are in use. I have an additional MS Direct Access VPN server on DMZ that needs to be configured and added to test.

Can I just use the same public ip as the current production server and configure it a hide address instead of doing 1:1 NAT ? We are using an external DNS glsb that uses the public ip to route traffic to nearest server. So needed to confirm if it will still work when we have 2 servers behind single NATed IP?

Re: NAT Question

Bob_Zimmerman — Fri, 06 Dec 2024 15:47:33 GMT

It should be possible with manual NAT. I'm not sure how automatic static NAT (which creates two static NAT rules) would interact with another thing hide NATing behind the same public address.

I personally would use manual rules and would change any private-to-public rule for the IP you want to use to switch it to hide NAT the internal system behind the public address. That way, all outgoing traffic uses hide NAT, and incoming traffic hits a single static NAT rule. Nice and simple.

Re: NAT Question

the_rock — Fri, 06 Dec 2024 16:09:53 GMT

Im with Bob on this one, sounds like the most logical approach.

Andy

Re: NAT Question

JayM1 — Fri, 06 Dec 2024 19:11:33 GMT

Ok will have a look.