topic Re: Configure NAT with multiple ports in General Topics

Configure NAT with multiple ports

Apadilla — Tue, 21 Mar 2017 23:35:47 GMT

Hello ocmmunity,

Do you know if it is possible to do this in the firewall ?

Name: NAT 1
Source Zone: INTERNET
Destination Zone: INTERNET
Source Address: IP_Public
Destination Address: 1.1.1.1
Service: icmp, tcp/5551, tcp/22, tcp/4443, udp/500, udp/4500
Destination Translation:Device (10.140.2.1)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

I know that Destination nat is one - to - one, so in this case

1. I will need to perform one NAT rule to each service. Correct ? In this case, one to allow port 5551, other to allow port 22, etc.

2. Is poosible that all these rules have the same Destination Address (Destination Address: 1.1.1.1) and same Destination traslation (Destination Translation:Device (10.140.2.1).

3. I have 3 security rules where I'm allowing these services.

3.1. Rule 1 allow the app "icmp",

3.2 Rule 2 allow ports 5551, 22 & 4443,

3.3 Rule 3 allow ports udp500 / udp4500

++++++++++++++++++++

I appreciate your feedback.

Best Regards

Andres

Re: Configure NAT with multiple ports

santonic — Wed, 22 Mar 2017 07:57:28 GMT

If you want to NAT ICMP (or any protocol other than UDP or TCP) you need to use any as service. So I suggest 1 NAT rule with any as a service and do your filtering with firewall rules (which is a good idea in any case).

Re: Configure NAT with multiple ports

reaper — Wed, 22 Mar 2017 09:14:39 GMT

You can combine all the UDP and TCP ports in one single NAT policy, you only need to add a port to the destination translation if you want to change the destination, eg. change incoming port 4443 to 443 on the webserver, but if the destination port does not need to change you can leave the translation port field empty

the only 'problem' is that ICMP can only be NATed through an 'any' policy so you'll either need to skip ICMP or create an 'any' policy and then filter based on security policies

Re: Configure NAT with multiple ports

Apadilla — Thu, 23 Mar 2017 18:06:10 GMT

Cool, I create 5 nat rules and working as expected , but is good to know this option to future implementations.

Thanks a lot for your feedback.

Best regards

Andres Padilla