Help to create rules for PAPERCUT (Printing program) for Wireless users on a Separate VLAN

[kalyanram.piratla]

Hi There,

I have got a program "Papercut" installed on my Fileserver1.  The program listens on port 9191.  ISP has created a sub-domain which routes all traffic using http://papercut.xxx.com to an external IP address of 213.1.215.4.

Shortcut to "Papercut" on our internal network is http://fileserver01:9191.  I want to implement a rule for the Wireless users on a seperate VLAN to be able to access "Papercut", since they are not recognized on our internal network's IP addresses.

I know we need to have a NAT rule created, but cannot get my heads around.  Help would be appreciated.

Thank you

Regards,

Kal

[mikand]

No need to use NAT in your case.

I assume your fileserver1 have a defgw which points to your router.

You can then put a static route entry in your router to point out where the wifi-clients are connected (iprange of wifi-clients with nexthop to your PAN box - I assume your network is similar to router <-> PAN <-> access-point <-> wifi-clients).

Or am I missing something here?

Then in your PAN you can as debug just allow appid:any, service:tcp9191 to see how PAN will detect the flows and once found out limit the appid to only use the detected application(s).

[rmonvon]

Hi...are the wireless users on the same private IPs as your server?  If so, you may need to do U-turn NAT.  See:  https://live.paloaltonetworks.com/docs/DOC-1678.

Thanks.

[kalyanram.piratla · Accepted solution]

Fixed it.  U-turn NAT was required.  Thanks Guys...

Regards,

Kalyan