Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 4075 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Nat question - Masq or SNAT

Louis-M

I have 4 internal lans:

LAN A = 10.1.1.0/24
LAN B = 10.1.2.0/24
LAN C = 10.1.3.0/24
LAN D = 10.1.4.0/24

I have 3 WAN's:

WAN A = 1.1.1.1
WAN B = 2.2.2.2
WAN C = 3.3.3.1/29  (goes to 192.168.1.0/24 via 3.3.3.2/29)

I want to nat all LAN's to various WAN's

LAN A >>> WAN A (using Masquerade)
LAN B >>> WAN B (using Masquerade)
LAN C >>> WAN C (using Masquerade)

I want LAN D >>> WAN C (using Masquerade)

However, I also want LAN A to nat to WAN C when a user tries to get to 192.168.1.0/24

Bear in mind that LAN A already has a masq rule to WAN A



This thread was automatically locked due to age.
  • 0

    Think I've done it but unfortunately, I don't have access to the other end of WAN C to see what is hitting it ie is it the masq ip or the actual source ip?

    My understanding of this is:

    It doesn't matter what is on the LAN side of WAN C. Everything coming out of LAN C will appear to come from 3.3.3.1

    So a client on LAN A (10.1.1.0/24) will appear as 1.1.1.1 coming out of WAN A but will also appear as 3.3.3.1 if it is routed to WAN C to reach another another network.

  • 0

    Hi,

    I think you require a Policy route on this requirement. PFA screenshot,

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0

    Like Sachin says, if you want to do it the old-fashioned way [;)], you also need a Policy Route for each LAN.

    The easier way to do this is with Uplink Balancing.  Use Multipath rules with persistence by interface.  Depending on whether or not you want to allow a LAN to use one of the other WAN connections if theirs dies, you might want to uncheck 'Skip rule on interface error' in the 'Advanced' section.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA