Solved

Watchguard 1:1 Nat Issue

Posted on 2012-04-04
3
746 Views
Last Modified: 2012-08-13
We have an xtm22 watchguard (should be similar on all models) but we have 2 external ip addresses for the sake of this ill use 1.1.1.1 and 1.1.1.2.
the watchguard external ip address is 1.1.1.1 and dynamic nat is using this for outgoing traffic and inbound main services SNAT using this. the issue i have is a webserver using 1:1 NAT of 1.1.1.2 -> 192.168.100.2 is not allowing internal users to connect using the external ip address i.e http://1.1.1.2. (it works fine from the outside)
could the issue be the way the watchguard handles this traffic now its 1:1 nat rather than just an snat like it used to be (which worked fine but outbound traffice wouldnt use 1.1.1.2, it would use 1.1.1.1 which was not wanted.)
0
Comment
Question by:active8it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
unsatiated earned 300 total points
ID: 37806129
Please provide a little more detail on the current configuration.  Where does the web server reside?  In a DMZ?  If the server is on the inside lan?  The reason your internal clients cannot browse to the 1.1.1.2 address is because that NAT is based on the external network interface.  You cannot traverse out that interface from your internal network to simply reach a device within your network.  You will require either utilizing the 192.168.100.2 ip address or NAT that IP to a different one on your internal interface.
0
 
LVL 2

Author Comment

by:active8it
ID: 37806274
correction the 1:1 nat is working outbound so for example the webserver does identify itself online as 1.1.1.2.
but to simplify trying to access 1.1.1.2 from other sites etc fails. the watchguard shows unhandled packet for example on http://1.1.1.2. ive tried both snat rule so: 1.1.1.2>snat>192.168.100.2 and also just 1.1.1.2>allow>192.168.100.2 both seem to give same result.
0
 
LVL 3

Expert Comment

by:unsatiated
ID: 37806498
What port are you attempting to connect on?  I assume 80.  In the firewall, have you created a allowance for that port to this server as well?
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Fraud Email 11 71
How can we use Acrylic Wi-Fi to observe our LAN 7 49
Mode / vector of infections and attacks 3 39
Problem to setting 16 45
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question