Port forwarding to internal IP connected to other firewall.

[KandarpDesai]

Hi Guys,

I need help with one scenario but it isn't working somehow. I want to make a rule to port forward a public IP to internal server. The issue is the internal server is connected to Lan zone of another firewall. Checkpoint and the other firewall are connected. (Checkpoint is the perimeter firewall and other one is internal firewall)

Comnection is as follows:
Checkpoint External interfc:Public IP
Checkpoint Internal interfce: 10.10.10.1
Other firewall External interfce:10.10.10.2
Other firewall internal intrfce:192.168.1.1

I want to Port forward from public IP to the 192.168.1.1. The only manual nat rule in Checkpoint is as follows
Og source:Any
Og destin:Public IP
Og service:Any
Trans source: Og
Trans destn: 10.10.10.2
Trans service:Any

On the other firewall rule there is a Port forward from 10.10.10.2 to 192.168.1.1

Am i missing something here. Should this work idealy?

[KandarpDesai]

Just some more info: We are able to access the 192.168.1.0/ network from CP and vice versa.
Also 192.168.1.0/ is able to access internet through CP gateway.

[Maarten_Sjouw · Accepted solution]

Ideally you would only NAT once, add a route for the 192.168.1.0 network to 10.10.10.2 and doe th nat on the external FW to 192.168.1.1

That being said, when you forward something to the internal IP of the other FW, this will probably not really work well as it might respond with it's external IP.

[KandarpDesai]

Hi,

I tried this but no luck yet.

[PhoneBoy · Accepted solution]

Why are you creating the NAT to forward to the other firewall?
Shouldn't the NAT forward the traffic to the actual IP of the server?
In which case, you need to make sure the Check Point gateways knows how to reach that IP, which would be done with routes.
Further, the internal firewall would have to be configured to allow this traffic and there would have to be routes to allow the traffic in the reverse direction.