NAT not working when applying WAN ip address object(created by custom)

Hi asl hknwk 

Not sure if I understand what you mean for Action token #3 but your DNAT rule should look similar to below image for DMZ Server B: 

After you create the DNAT rule, make sure you toggle it ON so it turns GREEN

If your DNAT rule is the same as above, please post snip of the Additional Addresses you created.

Thanks,

Karlos

Hi Karlos,

Thank you for the reply, My DNAT is look similar as yours and checked is turned ON.

Do you mean that i need to create  Additional Address that will be used for NAT at "Interface & Routing" then apply them to the NAT rules rather than apply the wan ip object created in "User & Definition"?

I am sorry i dont understand the different of this 2 type of object. And about the NAT rules it will be working when i apply my wan interface ip which is 100.10.10.1(address) but other wan ip address within the subnet except the wan interface ip address are not woring.

The test i did: 

Changed the wan interface ip address from 100.10.10.1 to 100.10.10.10 then the NAT rules with this wan ip address will be working, but the 100.10.10.20 NAT rules still no response,

Then change the wan interface ip address from 100.10.10.10 to 100.10.10.20, at this time the NAT rules with 100.10.10.20 wan ip address will be working but 100.10.10.10 will not working again. Please advise.

Many thanks!

Hi, and welcome to the UTM Community!

Yes, using an Additional Address is the right thing. See #4 in Rulz to gain a better understanding.

Cheers - Bob

Could you confirm you have the similar following 2 entries below under Interfaces & Routing > Interfaces > Additional Addresses:

Thanks,
Karlos

Thank you for the information. 

Hi Karlos,

Yes, i have created the similar additional address in  Interfaces & Routing > Interfaces for 100.10.10.10 and 100.10.10.20 then apply the "Address" to the NAT rules, but the NAT Rules is not working.And then i tried to custom create the address definitions for that 2 wan ip address then apply to the NAT rules, but the problem persists.

These days, i watched and found lots of video and guide for the NAT configure on Sophos SG, unlucky all the materials are using the wan interface ip address to apply to the NAT rules, none of them are applying another wan ip address like my case.

May i have any configure guide on NAT that applying wan ip address but not the wan interface ip address?

Many thanks!!

Hi asl hknwk 

We have a guide for DNAT setup with an additional address for Astaro Security Gateway: Astaro Security Gateway: How to Port Forward Service Ports with NAT

Scenario 3 will apply to your situation. The instructions will be slightly different. You can disregarded step 3 (Create Packet filter access). The equivalent of this is ticking the checkbox 'Automatic firewall rule' under the Action section of your NAT configuration.

Hi asl hknwk 

We have a guide for DNAT setup with an additional address for Astaro Security Gateway: Astaro Security Gateway: How to Port Forward Service Ports with NAT

Scenario 3 will apply to your situation. The instructions will be slightly different. You can disregarded step 3 (Create Packet filter access). The equivalent of this is ticking the checkbox 'Automatic firewall rule' under the Action section of your NAT configuration.

Thank you Karlos. My problem is solve.