• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 319
  • Last Modified:

one-to-one nat

From what I understand by default sonic walls lock down all port unless specified otherwise.  However I have been told that when I enable one-to-one nat this is not true for the public IPs I am forwarding.  Is this the case?  And if so when I start shutting down ports should I shut down the ports for the publics IPs or for the private IPs the Public IPs are being forwarded to or both?  Thanks.
0
srawtvl
Asked:
srawtvl
  • 2
  • 2
1 Solution
 
Tim HolmanCommented:
When you enable one-to-one NAT, you will also need to create a rule to allow traffic to hit those addresses.

For example, mail server public IP 20.20.20.20, private IP 192.168.0.1 -

You would enable one-to-one NAT to translate 20.20.20.20 to 192.168.0.1.
You would then create a firewall rule to allow port 25 to hit 20.20.20.20.

You do NOT need any more than this.  Everything else is implicitly denied, and traffic that is translated (as long as it's port 25) will be routed through to your private address without any additional rules.
0
 
srawtvlAuthor Commented:
This is not true.  I set up a bsd server behind the firewall and pointed a public IP to the private IP addy the bsd box is on.  I did not change any permissions on the firewall.  I am able to SSH to the bsd box from outside our network.  Can someone tell me if I should block ports to the public IP in this case or the private or both? and can someone tell me what sonic wall means by default in their services list?  is it the same as any on a cisco router?
0
 
srawtvlAuthor Commented:
OK so I answered my own question.  For anyone else who may need to know heres the deal.

Sonic wall explicitely allows everything.  You have to go in and remove the rules for the service "default" expect for where the source is LAN.

If you are using one-to-one nat you have to then go in and allow the services you need to the PRIVATE addresses.

And default means everything...how intuitive
0
 
Tim HolmanCommented:
..yet another firewall vendor doing things slightly different to confuse us !  :)
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now