Solved

Sonicwall  NSA 3500 - public server wizard results in dropped packets

Posted on 2013-12-31
5
655 Views
Last Modified: 2014-01-01
I have a sonicwall NSA 3500 sitting at a collocation center.
x0, Lan, 10.1.22.64/24, sits on lan vlan
x1, Wan, 75.75.210.234/24, sits on wan vlan
x2, Dmz, bridged x1, sits on dmz vlan (works fine)

I have a private server,  10.1.22.48 that I want to redirect 75.75.210.227 port 80, 443 requests to.  I've used the public server wizard and it only results in Drop Code 32 Module Id 26 in packet monitor.  I cannot for the life of me get these requests to be accepted and translated.

I have a similar configuration that I used public server to setup for 75.75.210.234->10.1.22.11 and it works great.  Just this new public + private IP do not work.  The private server is accepting requests on both ports.

I have an email server with a public IP on the DMZ vlan that works fine too, although it isn't using public server wizard settings, just firewall rules to allow the traffic through.
0
Comment
Question by:kzsigo
  • 3
5 Comments
 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
What is the SonicOS version.

You have /24 address for WAN, wow.
0
 
LVL 17

Accepted Solution

by:
lruiz52 earned 250 total points
Comment Utility
Don't use the wizard and try to do it manually, first create network objects for servers external and internal addresses, then create a 1-to-1 nat policy for incoming traffic, then create an access rule for incoming top 80 and 443 traffic.

Check the link below for how to

http://www.firewalls.com/blog/sonicwall-open-ports/
0
 
LVL 11

Assisted Solution

by:Miftaul
Miftaul earned 250 total points
Comment Utility
The meaning of SonicWall Dropcode and Module ID varies with firmware version. On SonicOS Enhanced 5.8.1.9-43o, Drop Code 32 means "Invalid connection cache", Module Id 26 means Network.

"Drop Code 32 Module Id 26" relates to dropped SSH/HTTPS session.

For more information on Drop Code and Module ID on SonicOS - Here

Sonicwall support documentation on port forwarding - Here
0
 

Author Comment

by:kzsigo
Comment Utility
I tried deleting all of the wizard rules, address objects, and setting them up manually but it did not take, same result.  

I saw the names behind the codes document, but I don't know how to solve the connection cache issue.  It's not the standard firewall blocked rule.  

I changed my DMZ X2 to Transparent mode, and my public servers all of a sudden work; I don't get the drop code, and the packets are forwarded/natted, even load balanced.  

However, now the server that is on the DMZ cannot communicate out X1 (originating from X2).   I'll ask a new question for that.  Thanks.
0
 
LVL 11

Expert Comment

by:Miftaul
Comment Utility
Please inform the SonicOS firmware version with your question.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

I was at a customer and we recently set up a new DNS Server.  I asked him to ensure that all servers pointed to the new server.  140 remote servers – estimated 6 days of work to do this manually. Ever had this experience and just need to get the …
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now