Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Adam_Sztymelski
Participant
Jump to solution

PAT/NAT to routed subnet?

Hi firewall masters!

I need your help with nat, port forward or whatsoever to confirm (or deny) my idea to grant access to my webserver from Internet.

We have /24 of public IP's, cutted on CP firewall. Some of them are used by network equipment, let say /29, and some of them by servers in DMZ, LAN, where ever was needed.

We have also few branches connected through sd-wan.

Subnet 172.16.0.0/24 is reachable by static route, its not directly connected.

And now i need to make visible in internet one server from that branch.

Is it possible to do this on CP by NAT, ARP policies?

When i did manual NAT, webserver 1.1.1.100:80 is reachable but only in LAN, never from outside.

Many thanks for your help, ideas how to achieve this.

Cheers!

#nat

#routing

#arp

#proxy

0 Kudos
1 Solution

Accepted Solutions
Michal_Gans
Contributor
Contributor

I think that easiest solution will be NAT 

srcdstservicenat srcnat dstnat service
internet1.1.1.100801.1.1.1 hide172.16.0.2original

But you lose information about source in web server logs.

View solution in original post

0 Kudos
5 Replies
Vladimir
Champion
Champion

If you are using manual NAT for an object, you have to resort to manual proxy ARP entries in Gaia.

If you are using static NAT to some local dummy IP, you can then use NAT rules to forward this traffic to its destination, so long as the routing is in place and the security policy permits it.

Adam_Sztymelski
Participant

Tried both with no success, apparently Im doing something wrong.

Can you give me some examples?

0 Kudos
Vladimir
Champion
Champion

Sorry, I am at CPX now and will not be by my lab for a few days yet.

0 Kudos
Michal_Gans
Contributor
Contributor

I think that easiest solution will be NAT 

srcdstservicenat srcnat dstnat service
internet1.1.1.100801.1.1.1 hide172.16.0.2original

But you lose information about source in web server logs.

0 Kudos
Adam_Sztymelski
Participant

Michal, this is it!

Many thanks!

Where i need to send you bitcoins?

Oh, no, they useless at this moment.

I can propose good real beer in Poland or in Czech.

Cheers!

PS. I used of course 1.1.1.3 (my active CP) not 1.1.1.1 in nat src. I understand it was just a typo. Just for those who they will looking for same solution.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events