This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAN -> LAN Keeping Firewall IP

Hello,

I'm a new user so maybe I doing something wrong but actually all my rules work, the only thing is after nat packet to the application the sourceIP the application see is wrong because it show the local ip for the firewall.

USER(91.10.10.10) -> INTERNET -> FIREWALL(10.10.1.30) -> NAT MASQUARADE -> 10.10.1.5 (I see 10.10.1.30 from here)

My Policy configuration is:

Source Host: Any

Hosted Server: WAN

Hosted Address: Port2(Public IP)

Protected Application:

- Zone: LAN

- 10.10.1.5

Port Forwarding:

- Protocol TCP

- Single Port

Routing:

- Rewrite Source Address: ON

- Use outbound Address: MASQ

Intrusion Prevention OFF

Trafic Shaping OFF

Reflexive Rule OFF

Thank you so much if someone can help me !

This thread was automatically locked due to age.

0 lferrara over 8 years ago

Hi Arnaud,

Are you publishing a web server? If the answer is yes, make sure you have selected "pass host header" option.
Cancel
Vote Up 0 Vote Down

Cancel
0 Emile Belcourt over 8 years ago

Hi Arnaud,

To preserve the originating IP for use in analytics on your webserver you will have to do as Lferrara says.

However your webserver may not be setup to use the header variable in this way and may require reconfiguration as detailed in this guide:

http://loadbalancer.org/blog/iis-and-x-forwarded-for-header

This was just a quick google, there are better guides out there.

Hope that helps,

Emile
Cancel
Vote Up 0 Vote Down

Cancel
0 MarcoScholl over 8 years ago

Routing:

- Rewrite Source Address: ON

- Use outbound Address: MASQ

This means SNAT! It sound you would like to have DNAT?
Cancel
Vote Up 0 Vote Down

Cancel
0 ArnaudCouturier over 8 years ago in reply to MarcoScholl

Thank you for your replies, it's not a webserver, my webserver rule work like a charm with Pass Host Header and X-Forwarding-For

I just want to redirect paquets that hit my firewall on X port to another lan address and port but keep the source IP to identify my users, if i disable Rewrite Source Address the rule stop working, this i why I turn on that.
Cancel
Vote Up 0 Vote Down

Cancel