topic Portforwarding and internal networks in Spark Firewall (SMB)

Portforwarding and internal networks

MatWre — Wed, 04 Aug 2021 14:13:36 GMT

Hello @All,

I would like to enable port forwarding that works from the outside, even on the LAN. A mobile app that communicates with a service via the public address should be forwarded directly to the destination when the device is on the internal WLAN. The WLAN is on the same network. That is, requests to the public service port should be forwarded directly to the internal server. Unfortunately, I have not been able to figure out how to accomplish this. All attempts have failed so far.
Example:
OrgSrc: <networkname>
OrgDest: <public IP>
OrgSrv: <serviceport>
TrlSrc: Original
TrlDest: <server with the service>
TrlSrv: original (and alternatively serviceport).

Notice:
In our CP FW 1530, 2 networks (switches) are defined. There is a NAT rule for each of these networks, since otherwise no Internet access is possible via the global parameter (NAT on). For this reason, the following NAT rule was created for each network:
OrgSrc: <networkname>
OrgDest: Any
OrgSrv: Any
TrlSrc: <public IP>
TrlDest: Original
TrlSrv: Original

How can I realize this feature?

Thanks for any suggestions

Mathias

Re: Portforwarding and internal networks

PhoneBoy — Wed, 04 Aug 2021 14:58:14 GMT

The correct way to do this is to create a server object (not a NAT rule).
And yes, there is a specific option in the server object to support the use case you’re describing.

Re: Portforwarding and internal networks

MatWre — Wed, 04 Aug 2021 17:04:50 GMT

A server object is existing. (Why do I've to define a port instead of a service object?) This object is working fine for external requests of the mobile device, but not for internal requests, while the requests are using the public IP. Access for all zones is activated.
NAT settings: Hide behind gateway
Advanced: Force translated traffic

Re: Portforwarding and internal networks

PhoneBoy — Wed, 04 Aug 2021 17:33:59 GMT

Server objects require defining the specific ports.
Regardless, I can confirm this is not working as expected.
Recommend opening a TAC case.