DNAT from Additional IP to a server in(azure) located on remote site via IPsec tunnel

Question

Hi all, 
 
 I'm having difficulties natting a simple https request on comming in on a aditional external IP to a server located in azure. 
 I have a working IPsec connection between my UTM and Azure, and i can browse the site from a local PC on the UTM internal network. 
 
 I have created a NAT rule like this: 
 Traffic from: Any 
 Using service: HTTP 
 Going to: External WAN (Address of alias) 1.1.1.2 
 Change destination to: Object created with server IP in azure 172.16.0.10 
 Service HTTP 
 
 Local LAN on UTM is 10.0.0.0/24 
 
 I hope someone can advise how to do this?

BAlfson · Accepted Answer

Shad, instead of 
 Change Source to: External IP on Wan interface 
 You want to use the "Internal (Address)" object. If you select ' Log initial packets ' in that Full NAT, you will have a record of the incoming IPs. Also, you can use a Services Group with HTTP and HTTPS in one rule. 
 I would humbly suggest that you don't want to take this approach though... 
 The rDNS/HELO check of incoming email traffic is impossible with a NAT from one site to the other. As those checks usually account for over half of the spam blocks, that's probably not what you want to do. For that reason, I would run the SMTP Proxy at the site where the MX record points and then have it send the traffic through the tunnel to your server. I wonder if the inbound HTTP/S traffic couldn't go directly to the site with the mail server. 
 Cheers - Bob

DNAT from Additional IP to a server in(azure) located on remote site via IPsec tunnel

Submitted a Tech Support Case lately from the Support Portal?