Solved

Watchguard 1:1 Nat Issue

Posted on 2012-04-04
3
742 Views
Last Modified: 2012-08-13
We have an xtm22 watchguard (should be similar on all models) but we have 2 external ip addresses for the sake of this ill use 1.1.1.1 and 1.1.1.2.
the watchguard external ip address is 1.1.1.1 and dynamic nat is using this for outgoing traffic and inbound main services SNAT using this. the issue i have is a webserver using 1:1 NAT of 1.1.1.2 -> 192.168.100.2 is not allowing internal users to connect using the external ip address i.e http://1.1.1.2. (it works fine from the outside)
could the issue be the way the watchguard handles this traffic now its 1:1 nat rather than just an snat like it used to be (which worked fine but outbound traffice wouldnt use 1.1.1.2, it would use 1.1.1.1 which was not wanted.)
0
Comment
Question by:active8it
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
unsatiated earned 300 total points
ID: 37806129
Please provide a little more detail on the current configuration.  Where does the web server reside?  In a DMZ?  If the server is on the inside lan?  The reason your internal clients cannot browse to the 1.1.1.2 address is because that NAT is based on the external network interface.  You cannot traverse out that interface from your internal network to simply reach a device within your network.  You will require either utilizing the 192.168.100.2 ip address or NAT that IP to a different one on your internal interface.
0
 
LVL 2

Author Comment

by:active8it
ID: 37806274
correction the 1:1 nat is working outbound so for example the webserver does identify itself online as 1.1.1.2.
but to simplify trying to access 1.1.1.2 from other sites etc fails. the watchguard shows unhandled packet for example on http://1.1.1.2. ive tried both snat rule so: 1.1.1.2>snat>192.168.100.2 and also just 1.1.1.2>allow>192.168.100.2 both seem to give same result.
0
 
LVL 3

Expert Comment

by:unsatiated
ID: 37806498
What port are you attempting to connect on?  I assume 80.  In the firewall, have you created a allowance for that port to this server as well?
0

Featured Post

Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question