topic Re: Manual NAT vs Static NAT in General Topics

Manual NAT vs Static NAT

Ihenock1011 — Mon, 02 Sep 2024 12:08:57 GMT

Hi All,

We have checkpoint security gateway r81.10 and We want to publish our web server to the public and we do a Manual NAT from the public IP to the local IP as below ;

Original Source : any

Original Destination: Public IP of my Web Server

Original Services: 443

Translated Source: original

Translated Destination: Local IP of my Web Server

Translated Services: original

However, the system is not reachable from public and I do Static NAT and It works what did I miss in the configuration and also is that possible to use the same public IP with different ports for different services I know it is possible to do in router is it possible to do on my gateways using Manual NAT?

Thanks

Re: Manual NAT vs Static NAT

G_W_Albrecht — Mon, 02 Sep 2024 12:14:48 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuide/Topics-SECMG/Configuring-NAT-Policy.htm?TocPath=Creating%20an%20Access%20Control%20Policy%7CConfiguring%20the%20NAT%20Policy%7C_____0

Re: Manual NAT vs Static NAT

Chris_Atkinson — Mon, 02 Sep 2024 12:27:23 GMT

The public IP is this on the same subnet as the external interface address or different i.e.

Do you need and have you configured proxy-arp to support the NAT?

Re: Manual NAT vs Static NAT

Ihenock1011 — Mon, 02 Sep 2024 12:34:30 GMT

@Chris_Atkinson The ISP provides the public and it is not mapped to any interface on the firewall side, we do routing to reach the firewall from the ISP router. I didn't do any Proxy-arp also.

Re: Manual NAT vs Static NAT

CaseyB — Mon, 02 Sep 2024 12:37:42 GMT

What does the firewall rule look like when it does not work?

Re: Manual NAT vs Static NAT

Ihenock1011 — Mon, 02 Sep 2024 12:40:43 GMT

The rule is the same in both cases.

Re: Manual NAT vs Static NAT

CaseyB — Mon, 02 Sep 2024 12:49:06 GMT

That could be the issue.

If you are allowing the Internet to a RFC1918 address, then only the static NAT would work. If you are doing the manual NAT, you need to allow the public.

Re: Manual NAT vs Static NAT

Ihenock1011 — Mon, 02 Sep 2024 12:55:57 GMT

@CaseyB Okay let me check then.

Re: Manual NAT vs Static NAT

Ihenock1011 — Mon, 02 Sep 2024 13:05:35 GMT

@CaseyB Thanks a lot it is working now by allowing the public instead of RFC1918 address.