Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 1849 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Server Access Assistant (DNAT)

Peter Geremia

Hello,

 

I just upgraded from v17 to v18.

 

Now I am going through the task of cleaning up all of the firewall and now the NEW NAT rules.

 

I decided to remove my previous NAT rules and use the Server access assistant (DNAT).

 

When using this it will create your Firewall RULE, And 3 NAT rules.  DNAT, Loopback and Reflexive.

 

After doing this I was going a bit crazy to understand WHY the loopback rule WAS NOT WORKING.

 

After running through a bunch of test scenarios I found that the firewall rule may not have been created correctly.  

 

The firewall rule ONLY was created with WAN as the source.  But in the case of loopback the source is LAN correct?

 

When I added LAN to the Source for the firewall rule everything was then working.

 

Can someone please tell me what I am doing wrong OR that maybe this is a bug in the wizard.

 

Thank You,

 

Peter Geremia



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to LuCar Toni

    I run a number of servers that are accessible via the Internet.   This includes security DVR, Mail, Web etc.

     

    When I am on the local network I want to access these via the Internet address not local address.

     

    IE: I need to access the different web sites by full Internet URL.

     

    Without loopback I cannot get to those servers from Inside the network only from Outside.

     

    -Pete

Children
  • 0 in reply to Peter Geremia

    Hello Peter,

    While creating from Wizard, you would need to manually define the matching criteria. 

     

    1) DNAT rule would have from ANY to ANY criteria which should have WAN as a source to LAN or ANY as the destination.

    2) Make sure NAT MASQ is applied on Loopback/Reflexive rule as there is a possibility of Asymmetric routing.

    3) Check on the packet capture provided under diagnostics using TCPDUMP. If it follows the correct NAT rule id.

     

  • 0 in reply to Aditya Patel

     I verified that if I do not have LAN as the source zone for the traffic, the loopback traffic (LAN to internal server via WAN IP) drops right to the DROP ALL rule at the end of the policy.

     

    Here is what my FW rule looks like.  I believe this is correct.  I did check NAT IDs against PCAP and it all looks right.

     

    Thank You,

    Pete

  • 0 in reply to Peter Geremia

    Hello Peter,

    DO check the packet capture tweaking the rules, you may use the filter based on port or host.

    e.g. BPF string. 

    host <ipaddress>

    port <portnumer>

    host <ipaddress> and port <portnumber>

    host <ipaddress> or port <portnumber>