topic Re: Public IP Ranges with NAT in Firewall and Security Management

Public IP Ranges with NAT

BlackBinNinja — Wed, 19 Apr 2023 11:00:19 GMT

Hi All,

I have come across an issue where I wanted to implement a NAT rule in Smartdasboard (R80.40) with the destination being a Public IP range i.e. None RFC 1918 ranges.

The only option I had as an object was "All Internet" which also covers the RFC1918 addresses. Do Checkpoint have an object that would exclude the RFC1918 addresses and include the Internet ranges.

Thanks

Re: Public IP Ranges with NAT

Chris_Atkinson — Wed, 19 Apr 2023 11:50:01 GMT

Are you able to share more details of the scenario?

Perhaps this can be addressed in combination with using strategically placed no-NAT rules for instance.

sk97246: Is it possible to add Group with Exclusions to the NAT rule base?

Re: Public IP Ranges with NAT

BlackBinNinja — Wed, 19 Apr 2023 11:58:41 GMT

Hi Chris,

We have implemented a work around using no-NAT but was interested to see if there was a specific group that only included non RFC1918 IP's.

I will most certainly look into the sk97246 method to see if that helps with my question.

Re: Public IP Ranges with NAT

PhoneBoy — Fri, 21 Apr 2023 00:11:26 GMT

Unfortunately, there isn't a single non-group object that excludes RFC-1918 but includes everything else.
Several "NO NAT" rules are the way to go here.