cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

PAT/NAT to routed subnet?

Jump to solution

Hi firewall masters!

I need your help with nat, port forward or whatsoever to confirm (or deny) my idea to grant access to my webserver from Internet.

We have /24 of public IP's, cutted on CP firewall. Some of them are used by network equipment, let say /29, and some of them by servers in DMZ, LAN, where ever was needed.

We have also few branches connected through sd-wan.

Subnet 172.16.0.0/24 is reachable by static route, its not directly connected.

And now i need to make visible in internet one server from that branch.

Is it possible to do this on CP by NAT, ARP policies?

When i did manual NAT, webserver 1.1.1.100:80 is reachable but only in LAN, never from outside.

Many thanks for your help, ideas how to achieve this.

Cheers!

#nat

#routing

#arp

#proxy

0 Kudos
1 Solution

Accepted Solutions
Michal_Gans
Nickel

Re: PAT/NAT to routed subnet?

Jump to solution

I think that easiest solution will be NAT 

srcdstservicenat srcnat dstnat service
internet1.1.1.100801.1.1.1 hide172.16.0.2original

But you lose information about source in web server logs.

0 Kudos
5 Replies
Vladimir
Pearl

Re: PAT/NAT to routed subnet?

Jump to solution

If you are using manual NAT for an object, you have to resort to manual proxy ARP entries in Gaia.

If you are using static NAT to some local dummy IP, you can then use NAT rules to forward this traffic to its destination, so long as the routing is in place and the security policy permits it.

Re: PAT/NAT to routed subnet?

Jump to solution

Tried both with no success, apparently Im doing something wrong.

Can you give me some examples?

0 Kudos
Vladimir
Pearl

Re: PAT/NAT to routed subnet?

Jump to solution

Sorry, I am at CPX now and will not be by my lab for a few days yet.

0 Kudos
Michal_Gans
Nickel

Re: PAT/NAT to routed subnet?

Jump to solution

I think that easiest solution will be NAT 

srcdstservicenat srcnat dstnat service
internet1.1.1.100801.1.1.1 hide172.16.0.2original

But you lose information about source in web server logs.

0 Kudos

Re: PAT/NAT to routed subnet?

Jump to solution

Michal, this is it!

Many thanks!

Where i need to send you bitcoins?

Oh, no, they useless at this moment.

I can propose good real beer in Poland or in Czech.

Cheers!

PS. I used of course 1.1.1.3 (my active CP) not 1.1.1.1 in nat src. I understand it was just a typo. Just for those who they will looking for same solution.