topic Re: what NAT and Network config in General Topics

what NAT and Network config

clonesheep — Mon, 19 Feb 2018 12:21:37 GMT

Hi,

I have a router from my carrier. This gives me an internal IP 10.0.9.3 /16 from my internal Network 10.0.0.0/16 network and the GW IP he gave me is 10.0.30.99.

Now he makes natting so i could get internet access and there i have a static official ip adress. for example 123.456.789

My test pc give it the ip 10.0.9.3 subnet 255.255.0.0 and gw 10.0.30.99 dns 8.8.8.8

Then my test pc have direct internet access. this settings i will configure now on my PA device.

Have configured a network interface and an trust and untrust zone. But how must i configure now NAT?

And what static routing? 0.0.0.0/0 to next hop ip 10.0.30.99 ?

Re: what NAT and Network config

RobinClayton — Mon, 19 Feb 2018 14:25:14 GMT

You need different subnets for your Trust and Untrust, your going to have to sort that first.

You really need the REAL external IP to be on the firewall.

Rob

Re: what NAT and Network config

clonesheep — Mon, 19 Feb 2018 14:54:40 GMT

Can i not make the untrust subnet as 10.0.9.3 /32 ?

I can not take the real external IP. There is no way because the carrier has a firewall there and they only can give me the real ip by NAT.

I know how @RobinClayton this means. But my carrier restrict me in this point.

Is there no other way?

Re: what NAT and Network config

RobinClayton — Mon, 19 Feb 2018 15:33:16 GMT

Get the carrier to change their internal subnet to something like

192.168.1.0/30

192.168.1.1 would be their router (and your default gateway out of the firewall)

192.168.1.2 would be your untrust interface.

10.0.9.0/16 would then by your trusted interface.

Re: what NAT and Network config

BPry — Mon, 19 Feb 2018 15:45:04 GMT

@clonesheep,

The firewall really isn't meant for a setup like this, and you may have to re-IP your internal network away from 10.0.0.0/16 to get things to work appropriately. I would recommend changing your internal network away from 10.0.0.0/16 just so that you don't have the 'internal' and 'external' networks in the same subnet; configure your 'internal' network as really anything else, for example 10.191.0.0/16 or 10.16.0.0/16 or whatever, and you won't run into any issues.