- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- Cloud Network Security
- :
- Discussion
- :
- Re: NAT in Aws Checkpoint instance
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
NAT in Aws Checkpoint instance
Hello,
I want to host a web server which is located behind a aws chexkpoint cluster but i am unable to figure outbhow the traffic from internet will hit the firewall vpc..i have elastic ip in that account which i have mapped with the web server via firewall nat.. But when i try to access it from internet there is no traffic on firewall
Any advice on what i am missing here.
Thanks
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @LostBoY,
1) Add a AWS route table to the cluster with the internal networks
2) Add default route to the internet on the gateway.
3) Create a NAT rule:
4) Creat a access rule5) Hide NAT for Web Server
6) Check AWS security groups (NACL) for the Elastic IP. Traffic must be allowed from the internet to Check Point firewall (cluster).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @LostBoY,
1) Add a AWS route table to the cluster with the internal networks
2) Add default route to the internet on the gateway.
3) Create a NAT rule:
4) Creat a access rule5) Hide NAT for Web Server
6) Check AWS security groups (NACL) for the Elastic IP. Traffic must be allowed from the internet to Check Point firewall (cluster).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1) can you please explain a bit more on point 1
2)I want to host a few webservers each with a dedicated IP.. so instead of hide behind gateway ..can i use hide behind ip address ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What i cant figure out is .. if i have an EIP by which i want to access the web server via Firewall ..then how do i associate that EIP with Firewall. i mean the routing part ..how will the internet know that for this particular EIP it has to reach this Firewall
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you still need help with this.
ASS now allows you to assign routing tables to the internet gateway in your VPC. So what you do is create a new route table with destination of your internal networks and make the firewalls external interface the hop for these. You then assign the route to the internet gateway. Assign elastic ips like you normally would to the internal hosts. When packets come into your VPC the internet gateway will know to route to the FW instead of directly to your internal host since you created that ingress route table.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, how do I have to add the Elastic IP?
I have multiple subnets attached via network interface to the checkpoint firewall. I got an Elastic IP associated to the network interface that connects the firewall and the subnet where my app server is.
In the checkpoint firewall I added the public IP as an Alias to the interface, and then I made all the steps you described. I also added an entry in the server SG for all traffic from de checkpoint SG (just for testing purposes) and did not worked.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where should EIP configured for Web server? on CheckPoint VM or another load balancer needs to be configured?
Blason R
CCSA,CCSE,CCCS
![](/skins/images/4BAE0211AB62E3B2F85E95CA468FEED0/responsive_peak/images/icon_anonymous_message.png)