CheckPoint firewall behind DSL router

From: Dave (withheld_at_nospam.thanks)
Date: 06/28/05


Date: Tue, 28 Jun 2005 19:55:24 GMT

Dear all,

Can anyone enlighten me on this? I'm trying to set-up a service (ftp for
example) running on a PC (IP:192.168.0.100) behind a CheckPoint R55 firewall
that is behind a DSL router (LinkSys) to be accessible from internet static
IP. I think I am having trouble with NAT between the router and firewall as
the packets don't even show up in the firewalll log. If I connect router to
the ftp server directly (with port forwarding) it works fine:
(Internet) ---Public IP(LinkSys Router)192.168.0.2---(fwd port 20 to
192.168.0.100:20)---192.168.0.100(FTP server)
The above only works if the ftp server has default gateway and DNS set to
192.168.0.2

What I want to achieve is this:
(Internet) ---Public_IP(LinkSys Router)172.16.1.2---(fwd port 20 to
172.16.1.100:20)---172.16.1.1(Firewall)192.168.0----192.168.0.100(FTP
server) with default gateway and DNS set to 192.168.0.2

Problem appears to be in NAT-ing 172.16.1.100 to 192.168.0.100 and NAT-ing
192.168.0.2 to 172.16.1.2

Here is what I tried:
Original packet:
    Source: 172.16.1.2
    Dest: 172.16.1.100
    Service: ftp-pasv

Translated packet:
    Source: original
    Dest: 192.168.0.100
    Service: original
--------------------
Original packet:
    Source: 192.168.0.100
    Dest: 192.168.0.2
    Service: Any

Translated packet:
    Source: original
    Dest: 172.16.1.2
    Service: original

What am I doing wrong?

Thanks,

Dave



Relevant Pages

  • Re: Hacked? External address knocks on internal private address...
    ... The important part of your message is that FTP is allowed out... ... You open a connection to an FTP Server and logon. ... When you ask the server for a file the server issues a "PORT" command ... so it can open a port on the firewall to allow the incoming Data ...
    (comp.security.firewalls)
  • Re: ipfw or ipf w/stateful behavior
    ... these make the firewall secure enaugh. ... > hosting a FTP server at your site? ... Securing things for an FTP client ...
    (FreeBSD-Security)
  • Re: Cannot Connect to FTP Server
    ... If I disable the Windows firewall, ... allow TCP port 21 in Exceptions it's not. ... FTP server)? ... test FTP server on a workstation on the ...
    (microsoft.public.windows.server.sbs)
  • Re: ipfw or ipf w/stateful behavior
    ... I take it you're trying to access a remote FTP server, ... Securing things for an FTP client ... firewall, that can detect the outgoing PORT command (with all the ...
    (FreeBSD-Security)
  • Re: McAfee Firewall Blocking FTP
    ... Note FTP and me not mix well ... >> If the firewall is turned off, I can open up a command window and ftp to ... >> McAfee's firewall that's blocking this packet. ... > FileZilla, allow, both directions, remote ports 20,21,1024-65535, local ...
    (comp.security.firewalls)