🚀 go-pugleaf

Hello Taoufik,

well understood.

Assuming that your NAT rules are correct, I think your problem relies on ARP.

The fact that you are on the same network/subnet for your internal address and
the NAT one, the router have nothing to do, your machine just try to resolve the
NAT IP address to MAC address (ARP !). I have seen that you tried arp -s for a
static arp, and I have done the same mistake myself at the beginning !!!
Your solution (I hope) is in using the file "local.arp" of the \state
subdirectory of your FW-1 (see the syntax in the manual for your OS, just create
it if it doesn't exists): the goal is, for FW-1, to answer with its MAC address
(the good side !), when someone tries to speak to the NAT address.
FW-1 needs to be aware of that, and a simple arp -s is not the solution.
You will need to fw stop/fw start if it seems not working.

Just let me know.

Best regards,
Olivier

Taoufik GABSI wrote:

> Hello Olivier,
>
> My problem is that I have an internal use machine 192.168.150.50 (it can not
> be sawn from the external network) and I want it to offer ONLY some  HTTP
> services to the extrnal network.
>
> So I wanted to configure may NAT like so:
> all connection incoming to VALID_IP wil be translated to 192.168.150.50 at a
> specific port.
> AND
> all connection incoming to VALID_IPZ wil be translated to 192.168.150.50 at
> another specific port.
>
> Thats why I cant use the automatic translation rule.
>
> In the FW guides, it seems to be so easy to configure.
> My Firewall logs say that the incoming packets have been translated to the
> right machine on the right service, but my local machine does not see any
> thing.
>
> Thank you for your help.
>
> Best regards,
>
> Taoufik GABSI.
>
> Olivier Merlin <omerlin98000@yahoo.com> wrote in message
> news:37F8C5BD.DEF0FEAA@yahoo.com...
> > Hello Taoufik,
> >
> > First of all, may I have some information on why and how you want to use
> NAT in
> > your configuration ?
> > IE, do you plan to see your LocalMachine (192.168.150.50) on your side
> with an
> > "external" NAT address of (for instance) 192.168.160.12 (and try to
> communicate
> > from your LocalMachine2 192.168.160.50) ??? To be well understood( my
> english is
> > not perfect), 192.168.160.50 will try to speak with 192.168.160.12 (same
> > network), and will go through NAT/FW-1 to your real 192.168.150.50 ?
> >
> > Second, have you checked the "automatically add translation rules" in your
> FW-1
> > (with GUI) ?
> >
> > I think I have the good answer for you, but I just want to understand what
> you
> > are trying to do before...
> >
> > If you have already succeeded, just let me know !
> >
> > Best regards,
> > Olivier Merlin
> >