[FW1] NAT and internal Hosts - additional??
fw-1-mailin...@lists.us.checkpoint.com
That's not entirely true!!!!
I can ping my internet address, but it only works for the first ping,
after that I get no response.
I think it is because the PC adds a route to it's routing table (as
described below), after it discovers that the host is actually
on the same subnet.
If you remove the route from your routing table (eg route delete
203.2.192.124), then ping again ,
you will get the same problem, ie the first ping will work but all
subsequent pings fail....
I am running FW1 3.0b build 3064 on NT 4.0SP3
The host is a Win NT 4.0 SP3 Server and have Win 95 PC's on the network
My Question is: does anybody have a solution to this??
I have a partial solution, but I would prefer a solution from an IP
routing guru....
Routing info
203.2.192.124 vaild internet address
192.168.1.124 internal host NAT address mask 255.255.255.0
192.168.1.100 internal PC mask 255.255.255.0
Route that is added to the routing table on the internal PC's machine:
Route 203.2.192.124 mask 255.255.255.255 gateway 192.168.1.124
Help,
Thanks,
Z
ze...@redback.com.au
========================================================
Hi,
You cannot ping to the real NAT address because the Fw is proxy arping
at the external interface.
Carlos Roque
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
fw-1-mailin...@lists.us.checkpoint.com
Sounds like you have still not added the arp entry to the firewall ?
---Carol Benton <car...@canmax.com> wrote:
>
>
> Zelko,
>
> I am not a routing guru but I have the same setup. pings are working
correctly.
>
>
> routing table for external nic:
>
> for 203 network
>
> 203.2.192.0 mask 255.255.255.0 gateway 203.2.192.124
>
> 203.2.192.124 mask 255.255.255.255 gateway 127.0.0.1
>
> 203.2.192.255 mask 255.255.255.255 gateway 203.2.192.124
>
> 255.255.255.255 mask 255.255.255.255 gateway 203.2.192.124
>
> 224.0.0.0 mask 224.0.0.0 gateway 203.2.192.124
>
> make sure you have ip forwarding checked under the network icon, hence
>
> you do not need a gateway for your internal nic.
>
>
> warmm regards,
> -
>
> <color><param>8080,8080,8080</param>Carol Benton
>
> Canamx Retail Systems, Inc.
>
> LAN Administrator 972-281-2312
>
> pager: 972-324-0824
>
> </color>
>
>
>
================================================================================
> To unsubscribe from this mailing list, please see the
instructions at
> http://www.checkpoint.com/services/mailing.html
>
================================================================================
>
_________________________________________________________
DO YOU YAHOO!?
Get your free @yahoo.com address at http://mail.yahoo.com
fw-1-mailin...@lists.us.checkpoint.com
Zelko,
The reason that it works first time and not thereafter is because the
Firewall's IP stack is forwarding the first Ping datagram but ALSO sends an
ICMP Redirect to the source PC telling it that there is a quicker route
(avoiding the Firewall!). Subsequent Ping datagrams are sent untranslated
direct to the target which doesn't recognise the destination address.
The solution is to block your Firewall from sending ICMP Redirects by adding
a policy rule (installed on Src, of course). The rule should be away from
the bottom of the list to avoid being overruled by the Allow ICMP property.
Cheers,
Dave Long
NCR UK
Opinions and statements in this email are mine and not necessarily NCR's.
> ----------
> From: Zelko Lukacevic[SMTP:ze...@redback.com.au]
> Sent: 03 August 1998 19:53
> To: fw-1-mai...@lists.us.checkpoint.com
> Subject: Re: [FW1] NAT and internal Hosts - additional??