Static NAT

[PhoneNewbie]

Hi there,

I have a Checkpoint Express NGX with 3 interfaces, 1 WAN, 1 LAN and one DMZ. After the intial install, everything appears to be ok, I can ping all the interfaces from the various networks and all is ok. The problem comes from trying to create a static NAT entry for our mail server in the DMZ.

On the firewall properties, I do NOT have hide all internal intefaces behind external interfaces checked.

I have created network objects for both the lan and dmz that ARE set to hide behind the gateway.

I have created a host object for the mail server on the dmz with a dmz address. I can ping the dmz address of the mail server from the lan. On the NAT tab of the host object, I selected static entry and entered the real routable address.

After installing the policy, I can still ping the dmz address but I cannot ping the routable address of the same box. Please advise what I'm doing wrong. Thanks so much!

Stu

PS - I currently have a default allow rule for all interfaces so there shouldn't be anything blocking security-wise, just nat screwup wise

 

[PhoneNewbie]

I re-read this and I can't make sense of it. Let's try again...

I have Firewall NGX and want to expose a machine on my lan to a publicly routable IP on the wan. The lan would be 192.168.0.123 and the wan would be 111.111.111.123 (made up). I have the following rules in address translation:

1.) Orig Pkt: source=lan ip, dest=any service=any
Trans Pkt: source=wan ip (valid add), dest=orig, service=orig

2.) Orig Pkt: source=any, dest=wan ip (valid add), service=any
Trans Pkt: source=orig, dest=lan ip, service=orig


Now, from outside our network, I can ping the wan address. But if I try to ping the wan address from the lan or from the actual gateway, it gets destination host unreachable. When I ping the wan IP from the gateway, it looks like it's trying to ping it on the external interface instead of translating it to ping the local ip. What am I screwing up? Thanks!

Stu

 

[FWHATER]

I'm not 100 percent sure, but it sounds like you have nat thru the firewall disbled. Local hosts won't use nat to reach an external address if it is disabled thru the firewall and you will only be able to reach the internal address. Hope that helps in any way.