For what is worth, though I know you said you followed the sk AI gave me in this example, but see below, hope it helps.
This is Check Point AI Assistant.
To configure NAT Loopback (Hairpin NAT / NAT Reflection) on a Check Point Security Gateway, follow these steps:
Background
NAT Loopback allows internal clients to access an internal server using its public IP address. This is useful when internal clients need to access services using the same domain name or IP address as external clients.
Network Topology Example
Consider the following network topology:
- Client #1: Public IP 2.2.2.2
- Client #2: Private IP 192.168.1.10
- Security Gateway: Public IP 1.1.1.1, Private IP 192.168.1.1
- Web Server: Private IP 192.168.1.2
Steps to Configure NAT Loopback
In SmartConsole R80 and Higher
-
Create Host Objects:
- Create host objects for Client #1, Client #2, Security Gateway, and Web Server with their respective IP addresses.
-
Configure NAT Rules:
- Open the NAT policy in SmartConsole.
- Add the following NAT rules:
| No. |
Original Source |
Original Destination |
Original Services |
Translated Source |
Translated Destination |
Translated Services |
Install On |
| 1 |
Client #1's Public IP (2.2.2.2) |
Web Server's Public IP (1.1.1.1) |
http |
Client #1's Public IP (2.2.2.2) |
Web Server's Private IP (192.168.1.2) |
= Original |
Security Gateway |
| 2 |
Client #2's Private IP (192.168.1.10) |
Web Server's Public IP (1.1.1.1) |
http |
Security Gateway's Private IP (192.168.1.1) |
Web Server's Private IP (192.168.1.2) |
= Original |
Security Gateway |
| 3 |
Web Server's Private IP (192.168.1.2) |
* Any |
http |
Web Server's Public IP (1.1.1.1) |
= Original |
= Original |
Security Gateway |
- Install Policy:
- After configuring the NAT rules, install the policy on the Security Gateway.
In SmartDashboard R77.X and Lower
-
Create Host Objects:
- Create host objects for Client #1, Client #2, Security Gateway, and Web Server with their respective IP addresses.
-
Configure NAT Rules:
- Open the NAT policy in SmartDashboard.
- Add the following NAT rules:
| No. |
Original Packet |
Translated Packet |
Install On |
| 1 |
Source: Client #1's Public IP (2.2.2.2), Destination: Web Server's Public IP (1.1.1.1), Service: http |
Source: Client #1's Public IP (2.2.2.2), Destination: Web Server's Private IP (192.168.1.2), Service: = Original |
Security Gateway |
| 2 |
Source: Client #2's Private IP (192.168.1.10), Destination: Web Server's Public IP (1.1.1.1), Service: http |
Source: Client #2's Private IP (192.168.1.10), Destination: Web Server's Private IP (192.168.1.2), Service: = Original |
Security Gateway |
| 3 |
Source: Web Server's Private IP (192.168.1.2), Destination: Any, Service: http |
Source: Web Server's Public IP (1.1.1.1), Destination: = Original, Service: = Original |
Security Gateway |
- Install Policy:
- After configuring the NAT rules, install the policy on the Security Gateway.
Important Notes
- Ensure that the NAT rules are in the correct order.
- Verify the connectivity and functionality after applying the NAT rules.
For more detailed information, you can refer to the Check Point support article sk110019.
