NAT with original destination option

ITMT · January 2018

Hello,

i have a question about NAT in a ZyWall device (USG210). I need to NAT traffic from DMZ (192.168.1.2) to LAN (172.16.48.2) for a specific port (tcp/1352), but only if original destination matches 10.0.1.2 (a device behind wan interface).

How to achieve?

Hint: with netfilter, I can achieve this by following rule:

iptables -A PREROUTING -i dmz -d 10.0.1.2 -p tcp -m tcp --dport 1352 -j DNAT --to-destination 172.16.48.2

Thank you.

Regards, Radim.

Image: https://us.v-cdn.net/6029482/uploads/editor/o6/5r3bygef2sq1.png

Zyxel_Charlie · January 2018

Hello ITMT,
You can follow the steps as below.
Create address object for DMZPC, LanPC and Lan interface.
Also create Service port 1352.

Image: https://us.v-cdn.net/6029482/uploads/editor/35/n9p4hs1z4ptc.png

Image: https://us.v-cdn.net/6029482/uploads/editor/jh/af2fjp1yrdtn.png

Create the SNAT profile on Routing page.

Image: https://us.v-cdn.net/6029482/uploads/editor/c3/ir9mc8xuj3xi.png

Charlie

NAT with original destination option

Comments

Categories

Security Highlight

Security Help Center