topic Re: Confusing NAT statements in Network Security

Confusing NAT statements

Brad_Shawh — Fri, 29 May 2020 19:14:03 GMT

I have a dmz server, listening on port 21, I want this server to be accessible from internet.

Here are my options:

nat (dmz,outside) source static ftp_10.20.30.40 x.x.x.x(publicIP) service FTP_21 FTP_21

^^ Does NOT work.

=============================================================

object network ftp_10.20.30.40
host 10.20.30.40
nat (dmz,outside) static x.x.x.x(PublicIP) service tcp ftp ftp

^^^ Works.

What is wrong with 1??? I am clueless. I have exact same NAT statement for another server (option 3) listening on a different port and it works.

3) nat (dmz,outside) source static 10.20.30.41 y.y.y.y(PublicIP) service 2222 2222

Re: Confusing NAT statements

Maykol Rojas — Fri, 29 May 2020 19:55:59 GMT

Hello,

It would be probable due to the type of service you are using to identify the port object. When you define the service object for port 21, is that using source? or Dest?

Mike.

Re: Confusing NAT statements

Brad_Shawh — Sat, 30 May 2020 10:48:01 GMT

Thank you.

I was using destination ports, but should it not be destination port 21 and not source? How does this work?

Re: Confusing NAT statements

Maykol Rojas — Sat, 30 May 2020 20:32:00 GMT

Hello;

It can be confusing because your clients are actually using port 21 as destination, but if you see it closely, the Server will be always using port 21 as source for the replies.

From a client initiating the conn (Initiating SYN):
Client--RandomSourcePort--Firewall--Server---Port 21.

When the server replies, it would look like this (Reply SYN-ACK):
Port21--Server ---Firewall---RandomSourcePort--Client .

For the firewall logic, it would statically map whatever that comes source on port 21 to the NAT address. That would allow anyone to send packets to that global IP and the firewall knows that if the source port is 21 (it will always be when the server replies) it will NAT it.

Hope it helps.

Re: Confusing NAT statements

Brad_Shawh — Mon, 08 Jun 2020 10:34:11 GMT

Thank you for the explanation 🙂