PAT/NAT to routed subnet?

[Adam_Sztymelski]

Hi firewall masters!

I need your help with nat, port forward or whatsoever to confirm (or deny) my idea to grant access to my webserver from Internet.

We have /24 of public IP's, cutted on CP firewall. Some of them are used by network equipment, let say /29, and some of them by servers in DMZ, LAN, where ever was needed.

We have also few branches connected through sd-wan.

Subnet 172.16.0.0/24 is reachable by static route, its not directly connected.

And now i need to make visible in internet one server from that branch.

Is it possible to do this on CP by NAT, ARP policies?

When i did manual NAT, webserver 1.1.1.100:80 is reachable but only in LAN, never from outside.

Many thanks for your help, ideas how to achieve this.

Cheers!

#nat

#routing

#arp

#proxy

[Vladimir]

If you are using manual NAT for an object, you have to resort to manual proxy ARP entries in Gaia.

If you are using static NAT to some local dummy IP, you can then use NAT rules to forward this traffic to its destination, so long as the routing is in place and the security policy permits it.

[Adam_Sztymelski]

Tried both with no success, apparently Im doing something wrong.

Can you give me some examples?

[Vladimir]

Sorry, I am at CPX now and will not be by my lab for a few days yet.

[Michal_Gans · Accepted solution]

I think that easiest solution will be NAT 

src	dst	service	nat src	nat dst	nat service
internet	1.1.1.100	80	1.1.1.1 hide	172.16.0.2	original

But you lose information about source in web server logs.

[Adam_Sztymelski]

Michal, this is it!

Many thanks!

Where i need to send you bitcoins?

Oh, no, they useless at this moment.

I can propose good real beer in Poland or in Czech.

Cheers!

PS. I used of course 1.1.1.3 (my active CP) not 1.1.1.1 in nat src. I understand it was just a typo. Just for those who they will looking for same solution.