Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 9 replies
  • Subscribers 6 subscribers
  • Views 1711 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Nat on static route in the same network

Daniel Huhardeaux

Hi all.

I create a static route of GW type to redirect local traffic goint to UTM (which is the network default GW) to another GW which take care of VPNs. Problem is that the redirected traffic is natted with the UTM IP instead of keeping the original one as the machines are in the same network.

How to avoid this behavior ? Version is UTM 9.707-5

Thanks for any hint

Daniel



This thread was automatically locked due to age.
Parents
  • +1

    You should check your NAT/masquerading rules.
    Seems one of them matches.
    If you found the problem, you may create a "NoNAT"-Rule.
    More Details or a short network sketch may be helpful.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    No NAT/masquerading involved in rules between same LAN. I follow your hint and created a NoNat rule and that solved the problem. Thanks

  • 0 in reply to Daniel Huhardeaux

    i think there is a default masquerading rule that catches your traffic.

    noNAT works ... great.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    This means that Uplink Interfaces is the culpit, all masquerading being done with this target (no SNAT). Which for me is wrong as it shouldn't interfere, source, UTM and new GW are in the same LAN.

  • 0 in reply to Daniel Huhardeaux

    Your Internal (LAN) is included in "Uplink Interfaces"?

    ... and yes Masqerading  Source=ANY --> Interface also works, if inbound and outbound interface is the same.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    Stock definition from UTM, never modify it:

    Uplink Interfaces = "Any" network, bound to interfaces with default IPv4 gateway

    Agree that LAN is included in this definition but still think that if GW is in the same lan it shouldn't masquerade.

  • 0 in reply to Daniel Huhardeaux

    why your LAN-Interface has an def. GW?


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    Dirk, in original post I explain the setup: UTM is default GW for the LAN. Inside the LAN I have a VM which take care on dhcp/DNS/VPNs/... In dhcp config (dnsmasq) I set option 121 static route to send IP of the VM as GW for networks behind VPNs. But some devices doesn't use dhcp so they send the traffic to UTM which will forward it to the GW: and bam, Natted IP. More clear ? ;)

  • 0 in reply to Daniel Huhardeaux

    ok, but you should use static routes at the SG and not a default gateway entry at the lan interface ...

    ... and I think there must be such a def.GW-Entry at the LAN Interface, because this move the interface to the "uplink-interfaces" 


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

Reply
  • 0 in reply to Daniel Huhardeaux

    ok, but you should use static routes at the SG and not a default gateway entry at the lan interface ...

    ... and I think there must be such a def.GW-Entry at the LAN Interface, because this move the interface to the "uplink-interfaces" 


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

Children
No Data
Unfiltered HTML