🚀 go-pugleaf

"Kenny" <kennywu@hotmail.com> wrote in message
news:159dc294.0310200837.74df0d6a@posting.google.com...
> Hi,
>
> I encountered a problem when I setup Checkpoint Firewall-1 NG on the
> network.
>
> For easy to identify the problem, I enabled "any" "any" services on the
> gateway (Firewall-1).
>
> It is only running NAT (hide) on the Firewall.
>
> From internal network client, I can ping, tracert, lookup external
internet
> website and public ip address by FQDN.
>
> But from IE in client computer, I can not open the web page, even I
entered
> website ip address directly in the IE address bar.
>
> Is there some special setting for HTTP access though checkpoint firewall
> gateway?
>
> Any tips will be apprecicated.
>
> Thanks,
>
> Kenny

Have you checked the log viewer to see why the traffic is being dropped.
This would be the first point of call!! Also, is the client set up to use a
web proxy perhaps?

Chris.

What are your rules? Did you verify / install after configuring?
What is in the log?


"Kenny" <kennywu@hotmail.com> wrote in message
news:159dc294.0310200837.74df0d6a@posting.google.com...
> Hi,
>
> I encountered a problem when I setup Checkpoint Firewall-1 NG on the
> network.
>
> For easy to identify the problem, I enabled "any" "any" services on the
> gateway (Firewall-1).
>
> It is only running NAT (hide) on the Firewall.
>
> From internal network client, I can ping, tracert, lookup external
internet
> website and public ip address by FQDN.
>
> But from IE in client computer, I can not open the web page, even I
entered
> website ip address directly in the IE address bar.
>
> Is there some special setting for HTTP access though checkpoint firewall
> gateway?
>
> Any tips will be apprecicated.
>
> Thanks,
>
> Kenny


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.528 / Virus Database: 324 - Release Date: 10/16/2003

Beoweolf (Beoweolf-spam@pacbell.net) wrote:
: What are your rules? Did you verify / install after configuring?
: What is in the log?


: "Kenny" <kennywu@hotmail.com> wrote in message
: news:159dc294.0310200837.74df0d6a@posting.google.com...
: > Hi,
: >
: > I encountered a problem when I setup Checkpoint Firewall-1 NG on the
: > network.
: >
: > For easy to identify the problem, I enabled "any" "any" services on the
: > gateway (Firewall-1).
: >
: > It is only running NAT (hide) on the Firewall.

here is the key right here. You say only hide mode NAT is configured. Any machine
that is offering a service that is based on a specific IP/Port must use static mode
NAT. Define the WEB server inside with a static NAT address. 

Also, as a rule, *never* do any/any/accept. Use a any/any/deny/log to see what you
are denying but do not let it through.



: >
: > From internal network client, I can ping, tracert, lookup external
: internet
: > website and public ip address by FQDN.
: >
: > But from IE in client computer, I can not open the web page, even I
: entered
: > website ip address directly in the IE address bar.
: >
: > Is there some special setting for HTTP access though checkpoint firewall
: > gateway?

"Richard H Miller" <rick@bcm.tmc.edu> wrote in message
news:bn1dlr$ph@gazette.corp.bcm.tmc.edu...
> Beoweolf (Beoweolf-spam@pacbell.net) wrote:
> : What are your rules? Did you verify / install after configuring?
> : What is in the log?
>
>
> : "Kenny" <kennywu@hotmail.com> wrote in message
> : news:159dc294.0310200837.74df0d6a@posting.google.com...
> : > Hi,
> : >
> : > I encountered a problem when I setup Checkpoint Firewall-1 NG on the
> : > network.
> : >
> : > For easy to identify the problem, I enabled "any" "any" services on
the
> : > gateway (Firewall-1).
> : >
> : > It is only running NAT (hide) on the Firewall.
>
> here is the key right here. You say only hide mode NAT is configured. Any
machine
> that is offering a service that is based on a specific IP/Port must use
static mode
> NAT. Define the WEB server inside with a static NAT address.
>

I think that he is trying to access web pages on the internet from a client
machine behind the firewall, not access a web server behind the firewall
from the outside. If this is the case then hide mode is the method to NAT
all the outgoing traffic from the internal network.

Kenny, is this what you are trying to do?

Chris.

Chris (chris@nospam.com) wrote:

: "Richard H Miller" <rick@bcm.tmc.edu> wrote in message

: > here is the key right here. You say only hide mode NAT is configured. Any machine
: > that is offering a service that is based on a specific IP/Port must use static mode
: > NAT. Define the WEB server inside with a static NAT address.
: >

: I think that he is trying to access web pages on the internet from a client
: machine behind the firewall, not access a web server behind the firewall
: from the outside. If this is the case then hide mode is the method to NAT
: all the outgoing traffic from the internal network.

: Kenny, is this what you are trying to do?


Re-reading it is hard to tell. Your reading may be correct. If so, the question is
what version of Checkpoint NG are you running and what type of platform is it on. There
are ARP and routing issues. How did you configure the NAT? 

rick

Hi All,

Thanks for all of tips.

I was going to test LAN users access internet though CP Firewall using 
Dynamic NAT (Hide).

After I checked traffic log in firewall and Client end proxy setting,
I found there is a MS proxy Client in the testing computer,
so, HTTP request has been forced to another proxy server which we disconnected.

Thanks for all again.

Kenny


rick@bcm.tmc.edu (Richard H Miller) wrote in message news:<bn1jsl$2fg@gazette.corp.bcm.tmc.edu>...
> Chris (chris@nospam.com) wrote:
> 
> : "Richard H Miller" <rick@bcm.tmc.edu> wrote in message
>  
> : > here is the key right here. You say only hide mode NAT is configured. Any machine
> : > that is offering a service that is based on a specific IP/Port must use static mode
> : > NAT. Define the WEB server inside with a static NAT address.
> : >
>  
> : I think that he is trying to access web pages on the internet from a client
> : machine behind the firewall, not access a web server behind the firewall
> : from the outside. If this is the case then hide mode is the method to NAT
> : all the outgoing traffic from the internal network.
>  
> : Kenny, is this what you are trying to do?
> 
> 
> Re-reading it is hard to tell. Your reading may be correct. If so, the question is
> what version of Checkpoint NG are you running and what type of platform is it on. There
> are ARP and routing issues. How did you configure the NAT? 
> 
> rick