Community discussions

MUM Europe 2020
 
omnicron
newbie
Topic Author
Posts: 27
Joined: Wed Dec 29, 2004 9:57 am

Exclude different /24 space on same interface from NAT rules

Tue Jan 22, 2008 2:02 am

MT 2.9.28

I have a public IPs that I NAT to inside IP space.

I have two subnets that I use on my internal interface.

It seems that when two machines that to each other on different IP on the private space they are NATed.

I see the session in the connection pool in the firewall section in MT.

The reason I say this is I added an IP filter to disable everything but port 80 traffic to the IP address of the inside IP for the NAT but it also blocks internal SQL sessions when the rule is in place that another computer is trying to make to the computer from the same interface but different subnet.

I think I need a mangle rule to exclude them from being NATed but I can not wrap my head around what needs to happen and if this is even occurring.

Does this sound right or am I just CRAZY?

Public IP *.38.27.228
|
MT
Int. 192.168.1.0/24 and 10.0.0.0/24

Thanks..
 
changeip
Forum Guru
Forum Guru
Posts: 3804
Joined: Fri May 28, 2004 5:22 pm

Re: Exclude different /24 space on same interface from NAT rules

Tue Jan 22, 2008 4:57 am

include the in-interface our out-interface on your nat rules so you are only natting when it traverses the internet wan.
Colo and Wholesale Bandwidth Available! Sales at SanDiegoBroadband dot com
 
omnicron
newbie
Topic Author
Posts: 27
Joined: Wed Dec 29, 2004 9:57 am

Re: Exclude different /24 space on same interface from NAT rules

Tue Jan 22, 2008 6:20 am

It does not let you set an incomming interface for the nat rules.


See error

ingoing interface matching not possible in srcnat chain

It will let you set it for outgoing. I have that done already.


Tim
 
goldclick
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Fri Sep 17, 2004 10:48 pm
Location: Nigeria
Contact:

Re: Exclude different /24 space on same interface from NAT rules

Wed Jan 23, 2008 2:24 am

It does not let you set an incomming interface for the nat rules.


See error

ingoing interface matching not possible in srcnat chain

It will let you set it for outgoing. I have that done already.


Tim
Correct! in-interface is for dst-nat. Use out-interface for src-nat and specify the interface that all traffic leaves, going to the internet.
Sunday Idajili
ITClick Networx Limited

Who is online

Users browsing this forum: bellotaman, eworm, Google [Bot], mbovenka, MSN [Bot] and 122 guests