Bill H
asked on
Sonicwall Change Outbound NAT for Server
Hey guys,
I have a Sonicwall NSA2400. Now one server, i opened a few ports to it and its working fine from the Outside. But when this server goes to the Internet, its going out with the Firewall's outside IP, i need to change this to a different IP. How would i do that on this firewall?
I have a Sonicwall NSA2400. Now one server, i opened a few ports to it and its working fine from the Outside. But when this server goes to the Internet, its going out with the Firewall's outside IP, i need to change this to a different IP. How would i do that on this firewall?
What IP do you need to change it to and why? Normal operation for a firewall is to use NAT (network address translation) to make everything look like it's coming from the internet side IP to protect all the computers behind it from being open and vulnerable to attack. Depending on what you want to do, it may be possible to do with the Sonicwall using virtual interfaces or DMZ. I think that we need more information in order to address this.
Yes you can do this. First make an address object for the ip you want it to be, Then make a nat rule for that server where translated from is that address object
Alternatively I suggest you use the public server wizard instead of doing this manually. Then edit the service group to have the services you want.
ASKER
So its for my mail server.
Internal ip -- 192.168.60.10
Outside Ip: x.x.x.55
Firewall outside ip: x.x.x.60
So from the outside to in using the 55 address it works fine. When the mail server goes out to the internet/sends email, it goes out as the .60 which is causing mail to get blocked because the rdns/forward dns do not match.
Internal ip -- 192.168.60.10
Outside Ip: x.x.x.55
Firewall outside ip: x.x.x.60
So from the outside to in using the 55 address it works fine. When the mail server goes out to the internet/sends email, it goes out as the .60 which is causing mail to get blocked because the rdns/forward dns do not match.
ASKER
Any thoughts guys?
Is .60 the default for all traffic?
I've already said how to do this, Just make a nat rule from the exchange host to the Internet (X1 probably) translated source .55.
http://help.mysonicwall.com/sw/eng/305/ui2/23100/Network/Add_NAT_Policy.htm
I've already said how to do this, Just make a nat rule from the exchange host to the Internet (X1 probably) translated source .55.
http://help.mysonicwall.com/sw/eng/305/ui2/23100/Network/Add_NAT_Policy.htm
ASKER
Aaron - thanks for the response.
Yes , .60 is the default.
Do i make a new rule or can i modify the existing NAT rule?
Right now my NAT Policy for this server is:
Original Source: Mail Server Private
Translated Source: Mail Server Public
Original Destination: Any
Translated Destination: Original
Original Service: Mail Server Services
Translated Service: Original
Inbound Interface: Any
Outbound Interface: X1
Yes , .60 is the default.
Do i make a new rule or can i modify the existing NAT rule?
Right now my NAT Policy for this server is:
Original Source: Mail Server Private
Translated Source: Mail Server Public
Original Destination: Any
Translated Destination: Original
Original Service: Mail Server Services
Translated Service: Original
Inbound Interface: Any
Outbound Interface: X1
What ip is "mail server public"?
ASKER
Mail Server Public is Outside Ip: x.x.x.55
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I changed Outbound Interface to Any and that got it. Thanks Aaron!
I've requested that this question be closed as follows:
Accepted answer: 0 points for Cobra25's comment #a40428926
for the following reason:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
Accepted answer: 0 points for Cobra25's comment #a40428926
for the following reason:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
I can't see comment numbers from the mobile site but this comment of mine was the final solution:
Change original service to any and see if that fixes it.
The last Author Comment tells different. The Outbound interface needed to get changed. No mentioning of the service being an issue.
Qlemo
Cleanup Volunteer
Qlemo
Cleanup Volunteer
ASKER
Please award Aaron points, he got me to the solution.