Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 19 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 100791 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allow single IP host through UTM to internal device/port

TomMorgan

I have a contract service tech who works offsite (we'll call Sam), and I have a "box" that he needs to access on-demand from time to time. Sam has a static public IP that needs to get through our SG UTM 9 to the box at 192.168.x.x, port 8080. I've had 1:1 setup which has worked fine until some fine folk found this little hole and have attacked it repeatedly with floods  & such. So now I only want Sam's IP to get through to the box.

Having RULZ 1-5 staring me in the face, I've tried a number of variations of NAT, with and without a firewall rule... firewall rule alone. I've even changed precedence of the rules temporarily. So to simplify, I need:
Only Sam at 1.2.3.4 -> to get through our UTM at 5.6.7.8 -> to the box at 192.168.x.x:8000

I've found a few similar threads but none were answered as solved or were similar enough to resolve this. This should be easy and I'm sure I've over thought it.

Thank you
Tom



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Ol Deda

    The tech is accessing this WEB interface with a software package that is unable to log into the user portal. It is a direct connection.

  • 0 in reply to TomMorgan

    I tried DNAT with a specified host and it works. I just specified the source too
    You can see from my logs

  • 0 in reply to Ol Deda

    Thanks but...

    My original DNAT which works:
    • For traffic from: Any
    • Using Service: 8080
    • Going to: WAN (Address)
    • Change destination to: 192.168.x.x
    • Automatic firewall rule: Yes

    Tried to close the hole so:
    Changed "Any" to the tech's external IP - didn't work
    Made my own firewall rule - didn't work
    Turned off firewall rule - didn't work

    And a number of other iterations that don't work. I'll take it up again Monday morning.

  • 0 in reply to TomMorgan

    How you defined the Sam IP? Network or Host

    Try to change the source port to 8282 an leave the destination to 8080. Because Web Filter owns the port 8080 (if it is active)

  • 0 in reply to Ol Deda

    Sam's IP is defined as Host. Thanks & yes, Web Filter is active, that never occurred to me. Changing to 8000 which is one of the comm devices choices. I'll report back when he contacts me this morning.

  • 0 in reply to TomMorgan

    Still not working. I have this DNAT:

    • For traffic from: Tech (1.2.3.4)
    • Using Service: 8000
    • Going to: WAN (Address) (3.4.5.6)
    • Change destination to: 192.168.x.x (comm box)
    • And the service to: (blank)
    • Automatic firewall rule: Yes

    Here's what I'm getting in the FW log:

                                   Techs IP      to    My External IP
    NAT rule #3  TCP  1.2.3.4:58384 →  5.6.7.8:8000

    It should be:
                                   Techs IP      to     IP of comm box
    NAT rule #3  TCP  1.2.3.4:58384 →  192.168.x.x:8000

    The strange thing is that I have two other DNATs to the same box, but using different ports and they "forward" correctly. The only difference is that the Traffic From is Any. It doesn't like a source IP

    Anything? Thanks.

  • 0 in reply to TomMorgan

    Try and move the DNAT rule to the top

  • 0 in reply to Louis-M

    Thanks but it's been at the top since I started having issues.

  • 0 in reply to TomMorgan

    On my home UTM (I'm not at work), my NAT rule X shows the remote ip hitting my external ip (WHITE colour) which is then followed by the remote ip hitting the internal ip (GREEN colour auto generated rule)

  • 0 in reply to TomMorgan

    The Firewall log is correct. What confuses me is the destination port. It is or not 8080? If your internal port is 8080, the destination port must not be BLANK

    The correct rule:

    • For traffic from: Tech (1.2.3.4)
    • Using Service: 8000
    • Going to: WAN (Address) (3.4.5.6)
    • Change destination to: 192.168.x.x (comm box)
    • And the service to: (8080)
    • Automatic firewall rule: Yes

    You can test it with your 3G mobile phone ip and see the firewall log RED

Unfiltered HTML