This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Internal NAT Rule

I know how to setup DNAT rules for external traffic getting forwarded to internal hosts. Here is what I'm looking to do. I have a DNAT rule in my firewall forwarding traffic from port 9090 to an internal servers Remote Desktop port. This works great for connecting to RDP while not connected to a VPN. The clients are using servers.domain.com:9090 to connect to the server. I would like to get an internal rule setup so when they come into the office they can still connect to servers.domain.com:9090. I'm guessing I'll need to point servers.domain.com to the internal Ip address of the firewall. I tried a few different DNAT and Full NAT configurations and was unable to get this to work correctly. Can anyone help? Also here is the configuration of the DNAT.

Traffic Source: Any
Traffic Service: 9090
Traffic Destination: External Address

NAT Mode: DNAT

Destination: Internal Server Ip
Destination Service: 3389

This thread was automatically locked due to age.

0 ChristopherRuh over 13 years ago

Are your clients sitting on the same subnet/interface as the server(s) or are they segmented?

Chris
Cancel
Vote Up 0 Vote Down

Cancel
0 Waterboy550_01 over 13 years ago in reply to ChristopherRuh

Same subnet as the firewall's internal Ip address and the servers Ip address.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

Try the KnowledgeBase article: Accessing Internal or DMZ Webserver from Internal Network

Also, another common error that people make is in the Host/Network definitions they configure. Check to make sure that the one for "Internal server IP" is not bound to a specific interface; all of the definitions you configure should be left with 'Interface: >'.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 13 years ago in reply to Waterboy550_01

Are your clients sitting on the same subnet/interface as the server(s) or are they segmented?

Chris

Same subnet as the firewall's internal Ip address and the servers Ip address.

Thanks!

Hi,

The VPN Pool should be a different network.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

Nice catch, Barry and Chris!

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Waterboy550_01 over 13 years ago

Got it to work. Here is the setup. Thanks for all the help! I am also using a custom port as I have a few different servers accessed using the same public Ip address.

Traffic Source: Internal (Network)
Traffic Service: Custom Port 9090
Traffic Destination: Internal (Address)
NAT Mode: Full
Destination: Server Ip Address
Destination Service: RDP (3389)
Source: Internal (Address)
Source Service: RDP (3389)

Love Astaro!
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

You could leave the Source Service empty, and this would work just fine, too.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel