Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 919 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ASL 3.2 & Masquerading Question (Sorry!)

Inix ZixinG
Hi All,

I'm terribly sorry if this comes to be "yet another stupid masquerading question" but I'm really stuck, even after reading everything that I'm supposed too.

I'm currently evaluating ASL 3.2, to replace it with our Checkpoint FW1. Current setup (Working now) is as follows

ADSL --> Checkpoint --> INT A

I would like to do the following for now

ADSL --> Checkopint --> ASL 3.2 --> Testing Desktop

Network Information
INT A: 192.168.100.0/24
Checkpoint: 192.168.100.1/24
ASL 3.2: 192.168.100.55/24 & 192.168.2.100/24
Testing Desktop: 192.168.100.55/24, Default GW, 192.168.2.100

ASL Network Information
External Net: 192.168.100.0/24
Internal Net: 192.168.2.0/24
eth0: 192.168.2.100/24
eth1: 192.168.100.55/24

Filtering Rules For ASL
Internal --> Anywhere = Allow
Anywhere --> Internal = Allow
External --> Anywhere = Allow
Anywhere --> External = Allow

Masqerading Rules for ASL
Network: Internal
Interface: eth1

I did some troubleshooting, and I determined that it should be the NAT at work.

When I typed the following in console

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

It worked!. I believe there must be something wrong in my ASL config. Can anyone please assist. Maybe anyone can assist me in using True NAT instead of IP Masquerading.


This thread was automatically locked due to age.
Parents
  • 0
    Inix ZixinG,

    your checkpoint doesn't know anything about your
    testing network (missing static route).

    If you MASQ your testing network to eth1, like
    you did with your iptables command it works.

    This can be done as well in the WebAdmin NETWORK/NAT,
    choose as type masq!

    read you
    o|iver
Reply
  • 0
    Inix ZixinG,

    your checkpoint doesn't know anything about your
    testing network (missing static route).

    If you MASQ your testing network to eth1, like
    you did with your iptables command it works.

    This can be done as well in the WebAdmin NETWORK/NAT,
    choose as type masq!

    read you
    o|iver
Children
No Data