Two nat rules for one port

ITMT · January 2018

Hello,

is it possible to NAT two differrent source addresses with one destination port and one public address to two different DMZ destinations?

Image: https://us.v-cdn.net/6029482/uploads/editor/dn/6y2hrkcodclh.png

Required behavior:
1. WAN client 50.10.10.10 requests connection on port tcp/80 with destination address 10.0.1.1
2. ZyWALL will check client source address (50.10.10.10) and destination port (tcp/80) and decides (according to NAT rules) to NAT traffic to the DMZ client 192.168.1.10, to the port tcp/80
3. WAN client 50.10.10.20 requests connection on port tcp/80 with destination address 10.0.1.1
4. ZyWALL will check client source address (50.10.10.20) and destination port (tcp/80) and decides (according to NAT rules) to NAT traffic to the DMZ client 192.168.1.20, to the port tcp/80

Thank you.

Regards, Radim.

PeterUK · January 2018

I don't think you can NAT two different source addresses with the ZyWall as is you can only NAT to the destination not from source to destination as source is any.

You could add it in ideas

https://businessforum.zyxel.com/categories/security-ideas

ITMT · January 2018

Thank you for response.

I recently switched from a linux system, so I am still comparing ZyWall firewall possibilities with netfilter/iptables.

With netfilter is pretty easy to apply following rules:

iptables -A PREROUTING -i wan1 -s 50.10.10.10 -p tcp --dport 80 -j NAT --to-destination 192.168.1.10<br>iptables -A PREROUTING -i wan1 -s 50.10.10.20 -p tcp --dport 80 -j NAT --to-destination 192.168.1.20

Anyway, thank you.

Regards, Radim

Zyxel_Charlie · January 2018

Thanks @PeterUK and @lan31 for sharing.

Hello ITMT,
The request "USG supports NAT port forwarding by source IP address", I would like to move your request to the ideas section."
Charlie

Ian31 · January 2018

I think USG does not support NAT port forwarding by source IP address in current version.
Not sure if this could be enhance in the future.

PeterUK · January 2018

This is whats needed

Then a rule for incoming source IP 50.10.10.20 to mapping IP 192.168.1.20

Two nat rules for one port

Comments

Categories

Security Help Center