DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

NAT vs firewall smackdown

More
25 Aug 2012 08:10 #73304 by jmls1
NAT vs firewall smackdown was created by jmls1
Got myself a 2850n - and have set up a NAT to go to one of my internal computers. I have also set up a firewall to prevent anyone external except a certain ip address from accessing this computer.

I *thought* that the firewall rule would kick in before the NAT rule, ie

check all the rules, if everything ok, then check NAT tables

however, it seems to be the other way around, as I turned off the firewall rule, and the NAT still worked.

Can anyone confirm this ?

thanks

Please Log in or Create an account to join the conversation.

More
29 Sep 2012 17:09 #73677 by jmls1
Replied by jmls1 on topic Re: NAT vs firewall smackdown
*bump*

anyone ?

Please Log in or Create an account to join the conversation.

More
29 Sep 2012 17:24 #73678 by jmls1
Replied by jmls1 on topic Re: NAT vs firewall smackdown
I *bump*. and then figure it out. Of course ;)

What I was missing was another rule after the allowed rule that blocked everybody else. I made the assumption that the absence of a rule would block by default.

Please Log in or Create an account to join the conversation.

More
09 Oct 2012 15:14 #73780 by chris_t
Replied by chris_t on topic Re: NAT vs firewall smackdown
Hi jmls

My understanding is that it starts from the logic in the default rule (either a pass or block), then applies the filter sets in the order you have set the 'next' numbers.

I missed the setting 'next' for a long while and then had to draw it out many times before I got mine to work as I wanted.

Please Log in or Create an account to join the conversation.

More
09 Oct 2012 16:36 #73781 by pwhodges
Replied by pwhodges on topic Re: NAT vs firewall smackdown
The Firewall is inside the NAT; if you have a server in a DMZ, for instance, the firewall rules for it must be written using the internal address, not the external one.

Paul

Please Log in or Create an account to join the conversation.

Moderators: ChrisSami