AnsweredAssumed Answered

Confused by Manual NAT Rules - kindly asking for clarification

Question asked by Georg Schwarz on Jan 29, 2019
Latest reply on Jan 31, 2019 by Hristo Grigorov

Inclined Readers,


This is my first post on Checkmates, I have done my best to find an answer, to no avail... I am afraid there is a misconception on my side.
However, if I am in violation of any rules explicitly stated or unwritten, my apologies beforehand...


My Question is concerning NAT-rules. We are replacing a lot of our customer's old Linux-based iptables Firewalls with Checkpoint 700 and 1400s. One of the common scenarios is that multiple servers are published using different public IPs.

As I was experiencing Problems with the Proxy ARP Checkbox in the GUI on some Firmware versions, I have most times manually edited the local.arp file and used manual NAT rules to get my stuff done. I checked this with Checkpoint support, and the gave me the go-ahead for this procedure.


However, what strikes me is that although I can use Manual NAT rules for all additional IPs, manual NAT rules for the boxes 'Primary' IP (the one shown on the Internet Connection) are completely ignored, and I will again have to use the New Server wizard. Mixing both of these approaches seems extremely inelegant, but for me it now seems to be the only way to get things working. I just ran into it agian on a box with R77.20.85 installed...


In fact, I would be really pleased if I could only just create manual NAT rules and matching access Policy rules - I guess it kinda makes me feel at home with the PREROUTING and FORWARD chains of iptables. ;-)


My Questions in particular are:

- Am I getting something wrong here, or is this behavior by Default?

- Is there anything I could do to make a 700/1400 Gateway work in a way that I can work without the Publsih Server wizard?


The only thing I relating to that behavior I have found in the documentation (ApplianceLocalAdminGuide) of the Small Business series is:

If servers with NAT are configured, the manual NAT rules do not apply to them. However, they apply even when Hide NAT is activated. 

To me this can mean anything. What I have oserved so far is that the behavior is that even when I have no servers defined, the manual NAT rules on the Primary IP are just being ignored...


Well People thank you for reading the entire post, I did not know how to use fewer words.

Thanks in Advance



ADDITIONAL INFORMATION (For those who really like to read Long stories)

- The Screenshot shows a manual NAT rule that Redirects traffic to a Linux Server with its own Firewall that only accepts packets from the local Network. The rule only works if the translated Destination object is shown as a Server... (And I can only create this one by the New Server Wizard, including the autogenerated-rule which I cancel out by my manual rule anyway).

If I just create the same rule without the New Server wizard and use an Single-IP-Object that I created, it doesn't work… However if I do the same config on an proxy-ARPed IP (entered in local.arp) it works like  charm *headscratch*

The Hide NAT INTERNAL_IP object is just here to make the packet appear from the SG, tricking the Server into thinking its from the local Network...