1

Our Internet line is configured as follows (IP addresses are simplified placeholders, but it's the same layout):

Subnet:              192.168.200.0/24
Default gateway:     192.168.200.1
Public interface IP: 192.168.200.2
SMTP:                192.168.200.2:25 (translates to 192.168.0.2)
Email web interface: 192.168.200.2:80 (translates to 192.168.0.2)
VPN device:          192.168.200.3:80 (translates to 192.168.0.3)
My computer:         192.168.0.50

Notice that the main public IP is NATted to several services on a server on the back-end, and that different devices utilize the same port for different services.

My problem is this: I'm having trouble with NAT reflection (accessing a device on my LAN from its public interface). From what I understand, I need to translate my computer's IP to the public IP, so the router will properly un-NAT my packets and send them back to me. However, I've tried just about every combination of NAT rules I can think of and it still doesn't work for me. We did move to a new location recently, and one of the only things changed in our Sonicwall was the settings for our WAN interface. Are there any problems with the configuration above that are interfering with my attempt to configure NAT reflection?

Improve this question

2 Answers 2

Reset to default
0

Your search term is "NAT hairpin". I don't use SonicWall, but I found this video which seems to describe how to do it:

http://www.firewalls.com/videos/video/sonicwall-loopback-nat-policy.html

Improve this answer
3
  • It's behind a paywall :\
    – Bigbio2002
    Feb 6, 2012 at 22:39
  • Ah, crap. Sorry. I was just doing the "NAT hairpin Sonicwall" search and came across that.
    – cjc
    Feb 6, 2012 at 22:40
  • He's right though. You'll want to add a NAT rule that translates the source from "Firewalled Subnets" to "WAN IP".
    – Jim G.
    Feb 9, 2012 at 22:14
0

It turns out I had NAT loopback configured correctly, but there was a bug in SonicWALL's implementation of 802.1p QoS that was causing loopback traffic to be dropped. There was nothing wrong with the IP configuration.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .