Public wifi clients unable to access our public web servers

[Maxstr]

Our public wifi traffic is unable to reach our external web servers that have public IPs (like webmail). The public wifi network is in the same zone, but it is assigned 172.30.0.0 IP, and we have ACLs to prevent the 172.30.0.0 network from talking to 192.168.0.0.  It is also being outbound NAT so it gets assigned a different public IP address than our regular traffic.

When I do an nslookup on public wifi, it gets the public IP address of the web server.

This is the U-Turn NAT I have tried, but I haven't gotten it to work: 

source: trusted, dest: untrusted, dest int: any, source addr: 172.30.0.0/16, dest addr: [external IP of webserver], no source NAT, dest NAT: 192.168.254.100 (internal IP of webserver)

[OtakarKlier]

Hello,

I would check the order of your NAT rules. I suspect that another one is being used prior to this one. Try moving it up higher in the list.

Cheers!

[pulukas]

Do you have a matching security policy that allows the traffic from the public wifi zone to the dmz server zone.

[reaper]

is the 192.168.254.100  aware of the 172 network (does it have routes or will it bounce sessions back to it's default gateway)?

if the 192 host is aware of the 172 network it may create asymmetric routing, in which case you'll need to either remove the routes from the host or apply source NAT on the firewall so returning packets go to the firewall

the security policy should be implied, as it is trust to trust, but it may not be a bad idea to create one specifically for this traffic anyway, so you have accountability (make sure to set the destination IP to the public IP)

then make sure your u-turn policy is all the way at the top