topic Re: Public wifi clients unable to access our public web servers in General Topics

Public wifi clients unable to access our public web servers

Maxstr — Thu, 08 Sep 2016 17:15:14 GMT

Our public wifi traffic is unable to reach our external web servers that have public IPs (like webmail). The public wifi network is in the same zone, but it is assigned 172.30.0.0 IP, and we have ACLs to prevent the 172.30.0.0 network from talking to 192.168.0.0. It is also being outbound NAT so it gets assigned a different public IP address than our regular traffic.

When I do an nslookup on public wifi, it gets the public IP address of the web server.

This is the U-Turn NAT I have tried, but I haven't gotten it to work:

source: trusted, dest: untrusted, dest int: any, source addr: 172.30.0.0/16, dest addr: [external IP of webserver], no source NAT, dest NAT: 192.168.254.100 (internal IP of webserver)

Re: Public wifi clients unable to access our public web servers

OtakarKlier — Thu, 08 Sep 2016 22:17:17 GMT

Hello,

I would check the order of your NAT rules. I suspect that another one is being used prior to this one. Try moving it up higher in the list.

Cheers!

Re: Public wifi clients unable to access our public web servers

pulukas — Sat, 17 Sep 2016 15:04:28 GMT

Do you have a matching security policy that allows the traffic from the public wifi zone to the dmz server zone.

Re: Public wifi clients unable to access our public web servers

reaper — Mon, 19 Sep 2016 10:26:24 GMT

is the 192.168.254.100 aware of the 172 network (does it have routes or will it bounce sessions back to it's default gateway)?

if the 192 host is aware of the 172 network it may create asymmetric routing, in which case you'll need to either remove the routes from the host or apply source NAT on the firewall so returning packets go to the firewall

the security policy should be implied, as it is trust to trust, but it may not be a bad idea to create one specifically for this traffic anyway, so you have accountability (make sure to set the destination IP to the public IP)

then make sure your u-turn policy is all the way at the top