PDA

View Full Version : Destination NAT rule on medium level firwall



skyways
05-01-2008, 10:43 AM
Hi!

I'm using a Quadro2X (Firmware Version: 4.1.33/Release) with a PPPoE client on its WAN interface. The firewall level's configuration is at Medium.
I want to permit managment access from the WAN interface from any IP address, so I have done this configuration:
I've done a destination nat from the WAN interface to the LAN's Quadro interface (172.30.0.1). This is a screen-shot:
http://img238.imageshack.us/img238/5565/05anc0.png
and then i've enabled the rule
http://img87.imageshack.us/img87/9906/05bar0.png

Then, I tried to access to the Quadro by its WAN IP address but the firewall blocked me...
I've done some sniffing on the Quadro WAN's interface and I've seen that no TCP FIN ACK was there...

Is it possible that the firewall's medium level doesn't permit any destination nat?

skyways
05-01-2008, 11:32 AM
than I tried to change the destination nat to another host of the lan (172.30.0.250):
http://img215.imageshack.us/img215/7076/07aqz5.png
And the destination Nat is running!

Is possible to make destination nat to the IP Lan address of the Epygi Quadro?

KSComs
05-02-2008, 04:41 AM
This may seem a silly question - but why not create a VPN in the quadro and use that. Then you can see past the quadro and not only work on the quadro but also the telephones.

Regards

Kevin

skyways
05-02-2008, 05:40 AM
Yes, a VPN would be a solution... but for me is important to know if I can create destination NATs with this firewall's level...

KSComs
05-02-2008, 10:29 AM
I use something similar with my Quadro. But I have permanent IP address tables setup So I always know where im coming from.

Just as a thought ... can you use an IP range from the isps for management ?

Ie here in Oz we have 203.x.x.x and 202.x.x.x maybe substituting those with your countries subnets as an Address range might do what you want.

I havent tried this but I know I can access the Quadro remotely as described before and have managed the Quadro via anyones ISP. This method I know works.

Regards

Kevin