-2

I have a SRX100 firewall running JunOS 12.1. I have a WAN interface proxy ARPing ten or so static routable IPs. I have a LAN interface on a simple class-C subnet (we'll call it 192.168.0.x). I'm using destination NAT and appropriate policy openings to allow in selective services from WAN to LAN (e.g. POP, IMAP, HTTP(S), etc.). Everything is working as expected.

Currently I'm fudging local DNS to point to internal addresses for hosts which are exposed through NAT. However I'd like to have my internal clients hit these services (and only these services) through the external IPs so I can do away with the local DNS. I've also been told to soon implement a DMZ for certain forward-facing services which necessarily means creating rules like this. Can anyone point to a simple simple tutorial for allowing this using the Web interface GUI?

Would a simple augmentation of the existing destination NAT rules and policy suffice?

closed as off-topic by MadHatter, Rex, mdpc, Tim Brigham, dawud Mar 19 '14 at 19:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – MadHatter, Rex, mdpc, Tim Brigham, dawud
If this question can be reworded to fit the rules in the help center, please edit the question.

2

Have you looked at the nice Juniper KB article that is titled "How to setup Hairpin NAT"?

Configuration example from their page (obviously not using your IP address space):

set security nat source rule-set hairpin from zone default
set security nat source rule-set hairpin to zone default
set security nat source rule-set hairpin rule hairpin-source match source-address 10.0.0.0/24
set security nat source rule-set hairpin rule hairpin-source then source-nat interface

set security nat destination pool server address 10.0.0.5/32
set security nat destination rule-set hairpin from zone default
set security nat destination rule-set hairpin rule hairpin-destination match destination-address 155.100.1.1/32
set security nat destination rule-set hairpin rule hairpin-destination then destination-nat pool server
  • Edit: SSHed in and ran an adapted version of this, then applied corresponding rules in policy, and traffic is flowing. I think now I see where things belong in the GUI, thanks. – Ryan Mar 8 '14 at 5:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.