This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Static NAT question

I am relatively new to Astaro and so far I like what I see. I am used to Cisco and Checkpoint at the office and IPCOp/Smoothwall at home. My smoothwall died last night in a lightning strike. Alas, she was a good firewall for over 5 years. I decided to make the switch to the VM Astaro appliance. Many of the features are there. However, the address translation rules are a bit confusing for someone who, well, knows what they are doing with firewalls. Here is my scenario....

I have 5 public IP's from my provider. I have added them individually to the Interface --> additional Addresses section. I have defined my internal mail server on setup. The default public IP address, the initial one, it's IP address ends in 209. My MX record ends in 210. How do I get the Astaro to listen for port 25 traffic on 210 and do its fancy spam filtering? I also need all OUTGOING SMTP traffic to also go out on 210, not the default of 209. Where do I go to configure this? It is relatively urgent as I have customers who are unable to send or receive email. Also, I need to create rules for web (80 and 443) to go to that server for webmail. I have gone to Network Security --> DNAT/SNAT and tried to create rules there for allowing incoming port 25 and port 80/443 traffic. However, it is not allowed.

Full NAT [] Pluto
Traffic selector: Any → SMTP → External (WAN) [***.***.***.213] (Network)
Source translation: SMTP
Destination translation: Internal mail server SMTP
Automatic packet filter rule:
Initial packets are logged:

DNAT []
Traffic selector: Any → HTTP → External (WAN) [***.***.***.213] (Address)
Destination translation: Internal mail server HTTP

This thread was automatically locked due to age.

0 BarryG over 15 years ago

Hi, setting up Astaro with .210 as the first EXT interface might help.

Also, make sure you have packetfilter rules to allow the traffic (either using the 'automatic packet filter' or manually creating rules).

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 goose7791 over 15 years ago

Ok, so it looks like the NATTING is working... I see in the live log the line that says connection using NAT, and that is right. But tht next line under that is "Default Drop" where it promptly drops the packet. I have the packet filtering rule setup correctly, I thought... they look like this:

source: Any
Service: Email Mesaging
Destination: External WAN ***.***.***.213
Action: allow
Cancel
Vote Up 0 Vote Down

Cancel
0 goose7791 over 15 years ago

Got it... changed the destination to Internal Mail server and it worked. Sota.... I see traffic being allowed thru, but when I do a test from an outside network in, I get an error "connect failed" even tho the firewall says it is allowing it in. Closer and closer. Web traffic in is working, tho.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

I'm not sure I understand your setup, so please read this with a critical eye.  In general, when creating a NAT rule, it's better to NOT "change" SMTP to SMTP.  For example, in order to allow external access to Outlook Web Access, we use:
Traffic Source:  Any
Traffic Service:  HTTPS
Traffic Destination:  External [OWA_External] (Address)

NAT mode: DNAT (Destination)

Destination:  {Host definition for Outlook Web Access server}
Destination Service: {blank!}

If the SMTP Proxy is configured correctly, you don't need NAT to get traffic to your mail server.  As Barry says, the Astaro proxies assume that the primary address on the External interface is the one you want them to use.  If you want SMTP Traffic to leave from one of the Additional Addresses, you can use:
Traffic Source: External (Address)
Traffic Service:  SMTP
Traffic Destination: Any

NAT mode: SNAT (Source)

Source:  External [{Your .210 Additional Address}] (Address)
Source Service: {blank!}

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel