topic Re: PAT/NAT to routed subnet? in General Topics

PAT/NAT to routed subnet?

Adam_Sztymelski — Sun, 03 Feb 2019 18:41:23 GMT

Hi firewall masters!

I need your help with nat, port forward or whatsoever to confirm (or deny) my idea to grant access to my webserver from Internet.

We have /24 of public IP's, cutted on CP firewall. Some of them are used by network equipment, let say /29, and some of them by servers in DMZ, LAN, where ever was needed.

We have also few branches connected through sd-wan.

Subnet 172.16.0.0/24 is reachable by static route, its not directly connected.

And now i need to make visible in internet one server from that branch.

Is it possible to do this on CP by NAT, ARP policies?

When i did manual NAT, webserver 1.1.1.100:80 is reachable but only in LAN, never from outside.

Many thanks for your help, ideas how to achieve this.

Cheers!

#nat

#routing

#arp

#proxy

Re: PAT/NAT to routed subnet?

Vladimir — Sun, 03 Feb 2019 23:07:18 GMT

If you are using manual NAT for an object, you have to resort to manual proxy ARP entries in Gaia.

If you are using static NAT to some local dummy IP, you can then use NAT rules to forward this traffic to its destination, so long as the routing is in place and the security policy permits it.

Re: PAT/NAT to routed subnet?

Adam_Sztymelski — Tue, 05 Feb 2019 21:32:27 GMT

Tried both with no success, apparently Im doing something wrong.

Can you give me some examples?

Re: PAT/NAT to routed subnet?

Vladimir — Wed, 06 Feb 2019 02:02:33 GMT

Sorry, I am at CPX now and will not be by my lab for a few days yet.

Re: PAT/NAT to routed subnet?

Michal_Gans — Wed, 06 Feb 2019 13:21:47 GMT

I think that easiest solution will be NAT

src	dst	service	nat src	nat dst	nat service
internet	1.1.1.100	80	1.1.1.1 hide	172.16.0.2	original

But you lose information about source in web server logs.

Re: PAT/NAT to routed subnet?

Adam_Sztymelski — Wed, 06 Feb 2019 17:39:14 GMT

Michal, this is it!

Many thanks!

Where i need to send you bitcoins?

Oh, no, they useless at this moment.

I can propose good real beer in Poland or in Czech.

Cheers!

PS. I used of course 1.1.1.3 (my active CP) not 1.1.1.1 in nat src. I understand it was just a typo. Just for those who they will looking for same solution.