AnsweredAssumed Answered

NAT policy rules for internal interfaces?

Question asked by David Herselman on Sep 21, 2018
Latest reply on Sep 21, 2018 by David Herselman

We don't appear to be able to get a NAT rule to apply on traffic on an internal interface of a Gaia security gateway.

 

Background:

We have been using Squid proxies for over 20 years and have a variety of systems and deployment tools that have the proxy hard coded (cache.lair.co.za:3128). Whilst it is possible to enable a proxy service on security gateways and edit the default port (8080) to match our legacy environment, application control doesn’t work due to them being written only to match on direct connections (tcp:80 and tcp:443) and HTTP and HTTPS proxy connections on tcp:8080.

 

We subsequently have to leave the security gateway proxy port configured as 8080 and wanted to create a NAT rule to redirect inbound connections towards the security gateway on 3128 to 8080.

 

 

What we did:

  • Created a NAT rule:

  • Testing:

[davidh@zajnb01-kvm2c ~]# telnet cache.lair.co.za 8080
Trying 100.127.254.1...
Connected to cache.lair.co.za (100.127.254.1).
Escape character is '^]'.

[davidh@zajnb01-kvm2c ~]# telnet cache.lair.co.za 3128
Trying 100.127.254.1...
telnet: connect to address 100.127.254.1: Connection refused

 

 

Are there restrictions on NAT policies that I'm perhaps unaware of?

Outcomes