Solved

Port forwarding... twice?

Posted on 2009-05-10
6
437 Views
Last Modified: 2012-05-06
Here is the situation:

Internet---> Sonicwall ---> LAN ---> PIX ---> Webserver

Sonicwall port forwards port 443 to the PIX over the LAN.  The PIX port forwards port 443 to the webserver.  The webserver is unreachable from the Internet.  I'm not sure exactly why this isn't working but I have a feeling this isn't going to work.  Does this have to do with the fact that the client machine uses a randomly high numbered port when making connections and as a result this won't translate properly from the Sonicwall to the PIX?

What options do we have on making the Webserver reachable from the Internet going through two firewalls?

Thanks!

0
Comment
Question by:lighthousekeeper
6 Comments
 
LVL 7

Expert Comment

by:briandunkle
ID: 24349603
Do both firewalls give out DHCP addresses? If so, what ranges are they using?
 How are you doing the forwarding? i.e. what addresses are you using at each point?

I don't know about putting SSL specifically through two firewalls...might not be possible but we can certainly try.
0
 
LVL 7

Expert Comment

by:briandunkle
ID: 24349620
By which ranges I mean (outside address=?) <--> (internal network 1 range) <--> (deeper network 2 range)

Any chance of using a dumb switch instead of a firewall as the second, specifically meaning using IP addresses gotten from the FIRST firewall and just passed through? Actually a smarter switch should be able to do this, if you give machines in the inner circle, at least, static IPs.

(first firewall --> 192.168.0.2-20 <-- 2nd firewall --> 192.168.0.21.40 static

Dunno if I'm describing this well, but if you do static you should be able to do this.
0
 
LVL 7

Expert Comment

by:briandunkle
ID: 24349622
sigh, I mean 21-40, not 21.40
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 5

Expert Comment

by:sykojester
ID: 24349672
I'm guessing the SonicWall is acting as a NAT (Network Address Translation) and not a passthru device.  The PIX more than likely is doing NAT.

You cannot double NAT. You can only translate an IP address to once. i.e.  Internet IP of 1.2.3.4 -> SonicWall passing 10.10.10.2 to the PIX which is handing out 192.168.1.2 to your webserver.

Eliminate either the SonicWall or the PIX from the equation and everything should work just fine.
0
 

Author Comment

by:lighthousekeeper
ID: 24350357
Yep, I think you are right--cannot double NAT--they are both performing this function.  I would assume if the PIX was routing instead of acting as a NAT/firewall role that I would be able to put the route on the Sonicwall and then port translate to the routed network?

0
 
LVL 55

Accepted Solution

by:
andyalder earned 500 total points
ID: 24363520
Double NAT should work, here's a thread with several people who have got it working, If you're using NAT for inbound traffic then anyone accessing your site from behind a NAT firewall will be using double NAT because the address is translated at their firewall and at yours.

http://episteme.arstechnica.com/groupee/forums/a/tpc/f/469092836/m/4680930245

I would try testing with HTTP rather than HTTPS and it may also help to seperate the two NAT devices with a router.

0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Western Digital 2TB Red Not Being Detected By RAID Card 15 67
PCAnywhere 2 118
GPO - Prevent user group from saving files locally C; 8 80
Mac-address sticky 12 54
Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
Cybersecurity has become the buzzword of recent years and years to come. The inventions of cloud infrastructure and the Internet of Things has made us question our online safety. Let us explore how cloud- enabled cybersecurity can help us with our b…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

805 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question