Using DNAT and SNAT simultaneously.

[Elmir]

Hi Team,

I have a question about using DNAT and SNAT simultaneously.

For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.
When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32.

Is the configuration below workable?
------------------
config firewall vip
 edit "vip_192.168.10.10_Office-RDP"
  set service "TCP_42424"
  set extip 100.100.100.100
  set mappedip "192.168.10.10"
  set extintf "WAN_v2000"
  set portforward enable
  set mappedport 3389
 next
end

config firewall ippool
 edit "192.168.20.10/32_LAN-Office"
  set startip 192.168.20.10
  set endip 192.168.20.10
 next
end

config firewall policy

 edit 10
  set name "Internet->Office-RDP_allow"
  set srcintf "WAN_v2000"
  set dstintf "LAN_v2002"
  set action accept
  set srcaddr "Gr_AA" "Gr_BB" "Gr_CC"
  set dstaddr "vip_192.168.10.10_Office-RDP"
  set schedule "always"
  set service "TCP_42424"
  set nat enable
  set ippool enable
  set poolname "192.168.20.10/32_LAN-Office"
 next
end
------------------

[ozkanaltas · Accepted solution]

Hello @Elmir ,

Yes, this configuration will work. But I have a suggestion about DNAT. If you use extport instead of service this will work properly. 

config firewall vip
 edit "vip_192.168.10.10_Office-RDP"
  set extip 100.100.100.100
  set mappedip "192.168.10.10"
  set extintf "WAN_v2000"
  set portforward enable
  set extport 42424
  set mappedport 3389
 next
end

[ozkanaltas · Accepted solution]

Hello @Elmir ,

Yes, this configuration will work. But I have a suggestion about DNAT. If you use extport instead of service this will work properly. 

config firewall vip
 edit "vip_192.168.10.10_Office-RDP"
  set extip 100.100.100.100
  set mappedip "192.168.10.10"
  set extintf "WAN_v2000"
  set portforward enable
  set extport 42424
  set mappedport 3389
 next
end

[Elmir]

Hi,

Thank you!)

[Elmir · Accepted solution]

I made some adjustments.

Initially, it wasn't functioning with the dynamic NAT pool, so I configured it as interface SNAT instead.
Additionally, in the firewall policy, RDP should be permitted rather than the external port ("TCP_42424").

To summarize, the final configuration will look as follows:
------------------
config firewall vip
  edit "vip_192.168.10.10_Office-RDP"
    set extip 100.100.100.100
    set mappedip "192.168.10.10"
    set extintf "WAN_v2000"
    set portforward enable

    set extport 42424
    set mappedport 3389
  next
end

config firewall policy
  edit 10
    set name "Internet->Office-RDP_allow"
    set srcintf "WAN_v2000"
    set dstintf "LAN_v2002"
    set action accept
    set srcaddr "Gr_AA" "Gr_BB" "Gr_CC"
    set dstaddr "vip_192.168.10.10_Office-RDP"
    set schedule "always"
    set service "RDP"
    set nat enable
  next
end
------------------