topic Re: How to configure dynamic NAT IPs in General Topics

How to configure dynamic NAT IPs

clonesheep — Thu, 07 Jun 2018 14:39:10 GMT

I have a german ADSL connection and would like to make it accessible from outside. My server has internally the IP 10.0.109.111. From outside it is accessible via a DynDNS name because the public IP changes daily.
My router has the 192.168.4.1 IP and the PA 200 on the eth3 has the IP 192.168.4.2. From within the Internet I can also access this IP.
How do I set NAT policies to get from external to internal?

Look my policies...

Re: How to configure dynamic NAT IPs

Raido_Rattameister — Thu, 07 Jun 2018 15:05:28 GMT

I understand that this dynamic public IP is assigned to wan interface of the router. In this case you first need to set up port forwarning on router and then on Palo.

In this case Palo NAT rule looks like this.

Original Packet tab
Source zone - l3-untrust-1u1
Destination zone - l3-untrust-1u1
Destination interface - any will do the trick
Destination Address - 192.168.4.2

Translated Packet tab
Translation Type - Static IP
Translated Address - 10.0.109.111

Security policy
Source zone - l3-untrust-1u1
Destination zone - l3-trust
Source IP - any
Destination IP - 192.168.4.2

Re: How to configure dynamic NAT IPs

OtakarKlier — Thu, 07 Jun 2018 20:56:43 GMT

Hello,

In addition to this I would recommned not using clear text protocols such as FTP. There are free SFTP servers out there that you can use and would make your systems more secure.

Regards,

Re: How to configure dynamic NAT IPs

clonesheep — Fri, 08 Jun 2018 14:39:43 GMT

@Raido_Rattameisterthaht it was.. Destination interface - any will do the trick

@OtakarKlierI know ftp is bad.. but i think its an easy way to test connections. So i have a test server and can connect from outside to this one.