This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNAT Answers?

I'm having a problem with a DNAT.

I have multiple tomcat applications running on a box on one interface:

app1 - 172.16.35.2 and port 8080
app2 - 172.16.35.2 and port 8081

now I've created two DNAT rules to support these applications as http

DNAT
Traffic Source: corpNet-192.169.1.0/24
Traffic Service: http
Traffic Destination: app1-VIP-172.16.35.4
Destination: appsrv-172.16.35.2
Destination Service: tomcat-8080
Automatic PF Rules Enabled

DNAT
Traffic Source: corpNet-192.169.1.0/24
Traffic Service: http
Traffic Destination: app2-VIP-172.16.35.5
Destination: appsrv-172.16.35.2
Destination Service: tomcat-8081
Automatic PF Rules Enabled

Now I can't access either application. Telnet just times out as if the firewall is blocking the connection.

No denys are showing in the PF logs.

I thought maybe it's a proxy arp issue since these are not live IP's but since the FW is the default gateway I shouldn't need a proxy arp since it should xlate the address once the traffic is attempted to be route? Even if that were the case applying any additional interfaces on the FW (seem to be the only UI way to get an arp binds the portal to it negating my need for http/https port translation)

Any Ideas on what I can change to make this work?

This thread was automatically locked due to age.

Parents

0 kury over 17 years ago

what is the 172.16.35.0/24? network? is this on another interface separate from your 192.168.1.0/24 network?

Are you using the http proxy at all?
Cancel
Vote Up 0 Vote Down

Cancel
0 annubiz over 17 years ago in reply to kury

It is another network off of another interface. The proxy is not used.
Cancel
Vote Up 0 Vote Down

Cancel
0 annubiz over 17 years ago in reply to annubiz

Running TCPdump shows the requests coming in but they never make it to the detination interface.... running a dump on all interfaces seems to indicate that the traffic is just being dropped.

There are no drop entries in the live log as I'm attempting my requests
Cancel
Vote Up 0 Vote Down

Cancel
0 annubiz over 17 years ago in reply to annubiz

Problem fixed I did have to add bind the addresses to the destination interfaces it seems. After that I used the "auto created" interface object in the nat rule and traffic flows without a problem.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 annubiz over 17 years ago in reply to annubiz

Problem fixed I did have to add bind the addresses to the destination interfaces it seems. After that I used the "auto created" interface object in the nat rule and traffic flows without a problem.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data