Manual NAT vs Static NAT

[Ihenock1011]

Hi All,

We have checkpoint security gateway r81.10 and We want to publish our web server to the public and we do a Manual NAT from the public IP to the local IP as below ;

Original Source : any

Original Destination: Public IP of my Web Server

Original Services: 443

Translated Source: original

Translated Destination: Local IP of my Web Server

Translated Services: original

However, the system is not reachable from public and I do Static NAT and It works what did I miss in the configuration and also is that possible to use the same public IP with different ports for different services I know it is possible to do in router is it possible to do on my gateways using Manual NAT?

Thanks

[G_W_Albrecht]

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuid...

[Chris_Atkinson]

The public IP is this on the same subnet as the external interface address or different i.e. 

Do you need and have you configured proxy-arp to support the NAT?

[Ihenock1011]

@Chris_Atkinson The ISP provides the public and it is not mapped to any interface on the firewall side, we do routing to reach the firewall from the ISP router. I didn't do any Proxy-arp also.

[CaseyB]

What does the firewall rule look like when it does not work?

[Ihenock1011]

The rule is the same in both cases.

[CaseyB · Accepted solution]

That could be the issue.

If you are allowing the Internet to a RFC1918 address, then only the static NAT would work. If you are doing the manual NAT, you need to allow the public.

[Ihenock1011]

@CaseyB Okay let me check then.

[Ihenock1011]

@CaseyB Thanks a lot it is working now by allowing the public instead of RFC1918 address.