Natting & web protection

I'm confused Louis...

Any traffic processed by Web Filtering will go to the WAN port with the Primary IP of the Interface.  10.1.100.200 will no longer be the source IP of the packet, so no SNAT rule will apply to that traffic as it will to unproxied traffic from 10.1.100.200.

On 02-June-2017, How to change the outgoing interface for Web Filtering appeared, so it is now possible to assign different public IPs to different Profiles.  In this way, you could create a Web Filtering Profile for 10.1.100.200 and assign x.x.x.101 to that Profile.

I do like the idea of having all traffic coming and going using the same IP.

Cheers - Bob

Sorry Bob,

let me try and clarify. Lets take a non standard port say tcp 20000

So, 20000 tcp DNAT's to 10.1.100.101 (public ip 1.1.1.2)

10.1.100.0/24 masquerades to (1.1.1.1) and web filtering goes to the same (1.1.1.1)

Because the non standard port is DNATing  from 1.1.1.2, without a SNAT, traffic will appear to come from 1.1.1.1
Should an SNAT be put in to make the traffic come from 1.1.1.2 or should we just leave the masquerade in?

Basically with multiple public ip's, if you put a DNAT in, is it best practice to put a corresponding SNAT in?

If there's a reason, yes, but I otherwise like to keep things simple.  I'd do it with a mailserver or a server dedicated to a single customer or ...

Cheers - Bob