Allow single IP host through UTM to internal device/port

Have you tried source nat?

You can change the source port too. For example 3395 -> 3389 (rdp). And nobody will atempt to logon in your PC

Yes, I tried SNAT with DNAT also. The only way that works is if I open it up to the internet by setting source & service to any. I want to limit access to the service tech's IP.

Just to be clear, this is not a PC that is being accessed, it is a special comm control device with a WEB interface.

I will give it a try in my site. But this could be done with user portal if you want something secure

The tech is accessing this WEB interface with a software package that is unable to log into the user portal. It is a direct connection.

I tried DNAT with a specified host and it works. I just specified the source too
You can see from my logs

Thanks but...

My original DNAT which works:
• For traffic from: Any
• Using Service: 8080
• Going to: WAN (Address)
• Change destination to: 192.168.x.x
• Automatic firewall rule: Yes

Tried to close the hole so:
Changed "Any" to the tech's external IP - didn't work
Made my own firewall rule - didn't work
Turned off firewall rule - didn't work

And a number of other iterations that don't work. I'll take it up again Monday morning.

How you defined the Sam IP? Network or Host

Try to change the source port to 8282 an leave the destination to 8080. Because Web Filter owns the port 8080 (if it is active)

Sam's IP is defined as Host. Thanks & yes, Web Filter is active, that never occurred to me. Changing to 8000 which is one of the comm devices choices. I'll report back when he contacts me this morning.