• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1725
  • Last Modified:

dmz subnet is outside of wan subnet sonicwall NSA 2400

then assigned ip addresses provided to us are while the wan ip address  

x0:lan -
x1:wan -

how do I apply the addresses to the dmz? and to nat addresses?   I know how when I set the subnet to wan but that results is blocked traffic and obviously incorrect.  so I already have the address objects etc. defined.  
I just need to know how to apply the assigned ip range to an interface which falls outside of the wan subnet.

  • 2
1 Solution
Set the DMZ up as a SEPARTE private range, and NAT taht on to a differen't ip addres or set of addresses in the publich range available. e.g.


LAN email server (say) at  - NAT 1:1 mapping to
DMZ web server (say) at  - NAT 1:1 mapping to

DVDude_1Author Commented:
so move it completely from an externla dmz to an internal network with natting...  ok..   just asking because the setup of the 2400 is quite a bit different that the 2040pro(standardOS) that it is replacing.
Yes. Well, like the 2040, you *can* if you choose set the interface up as Transparent but unless you are running something which REALLY doesn't like NAT, a private range and NAT mapping would be by far the easiest route.

Then your LAN to DMZ routes, if any, are simply from private range to private range.

It's still "external" as far as your LAN zone(s) are concerned, i.e. traffic from DMZ to LAN still has to re-pass the firewall and be matched by DMZ-to-LAN rulesets or it won't happen, so a compromise of a DMZ host does not expose your LAN to the baddies.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now