topic Re: Cannot browse nat webpage internally in lan in General Topics

Cannot browse nat webpage internally in lan

mmxong — Tue, 12 Jul 2011 04:44:48 GMT

Hello All,

We have some internet facing servers who has NAT public address.

1) Externally we can access the public address of the server.

2) Internally on our LAN, we cannot access the public address of the server, it timed out. However the appliance monitor tab shows accept, nothing was denied.

The policy rules i set was

Any to Any - Server_public_address - Web browsing allowed

Anyone knows what could be causing this issue ?

Thanks

Ben

Re: Cannot browse nat webpage internally in lan

kbrazil — Tue, 12 Jul 2011 05:42:56 GMT

If the clients and the servers are on the same LAN then the response from the server is likely going directly to the client and not back through the firewall. The client is receiving a response packet with the internal address instead of the external one so it rejects the packet as unexpected.

To fix this scenario you can set up a Source-NAT + Destination-NAT rule from the client subnet to the servers so the return traffic is forced back to the firewall and correctly processed for NAT and security before it gets to the client. This concept is known as a U-Turn NAT Rule.

Cheers,

Kelly

Re: Cannot browse nat webpage internally in lan

bhelman — Tue, 12 Jul 2011 18:05:44 GMT

I just posted a somewhat similar issue. Explicitly allowing the traffic (even though the logs were not showing anything was blocked) resolved the problem. My post asked why this behavior is occuring.