Port Forwarding/NAT Issues

[wallbert]

I just set up my PA-200 and I'm trying to get my Plex server (on my LAN) to be accessible via WAN. I don't think I fully understand how NAT and security policies intertwine so I'm rather confused

I'm able to get LAN traffic outbound, but for one reason or another, I can't seem to get either my NAT or security policies correct to allow traffic in to my Plex server

I'm not sure what information to post, but I would appreciate some guidance on this

[aleksandar.astardzhiev]

Hi @wallbert 

Creating rules and NAT for inbound traffic with Palo Alto FW can be confusing at the beginning, but everything will make sense once you understand the order of operations.

- PAN FW is dermining the destination zone using route lookup - it will check its routing table for the destination address and see which zone will be used to egress the traffic

- In general when packet hits PAN FW it will apply the following order

1. Evaluating the NAT policies - only check if NAT is required, but without applying it
2. Perform security rule lookup - will check if traffic is matching this traffic
3. Apply NAT if any and forward the traffic

Each policy lookup (nat and security) is performing route lookup - the NAT rules will try to find destination zone for the public IP address (before the NAT being applied). Because your public NAT address is part of the public network assigned to the FW outside interface (or it is part of additional public range routed to your FW, which does not existing in your network) route lookup will match the default toute - FW will associate the public NAT ip with your outside zone.

Security policy lookup will again perform route lookup, but it already know that destination NAT will be applied, so it will check how NATed (private address) will be routed and use that zone as destination. But since the NAT is not yet applied, packet is still using the public IP.

[TomYoung]

Hi @wallbert ,

Here is an article with NAT and security policy examples to show you how to do it.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/nat/nat-configuration-examples...

Thanks,

Tom

PS In the security policy, pre-NAT IP and post-NAT everything else.

[wallbert]

Thank you for the detailed explanation. I've found that my Palo doesn't support uPnP, which I require for my network for gaming, so I will end up using the Palo in a lab environment instead