The following NAT rules will perform the required NAT: The Security Gateway determines that the packet is part of a previous connection and performs NAT on the packet to change the Source IP address from Web Server's private IP address 192.168.1.2 to its public IP address 1.1.1.1 (the destination IP address 2.2.2.2 is not changed): Source / DestinationĬlient #1 receives the reply packet it expects, and the connection is established. The Web Server sends a reply packet with a Source IP address 192.168.1.2 to a Destination IP address 2.2.2.2: Source / Destination The Security Gateway performs NAT on the packet and changes the Destination IP address from 1.1.1.1 to Web Server's private IP address 192.168.1.2 (the source IP address 2.2.2.2 is not changed): Source / Destination (2) Connection flow from Client #1 on public network to the Web Server:Ĭlient #1 sends a request packet with a Source IP address 2.2.2.2 to a Destination IP address 1.1.1.1 (on TCP port 80) to request some web resource: Source / Destination Server is NATed behind the Security Gateway.Ĭlient that connects from the internal network to the Web Server at its Public IP address 1.1.1.1.

Serves the data requested by the Clients. Performs NAT for Web Server - hides the Web Server's private IP address behind the public IP address.Ĭonnects devices on the internal network to the Security Gateway. (1) Consider the following network topology (based on ):Ĭlient that connects from the public network to the Web Server at its Public IP address 1.1.1.1.

Introduction to NAT Loopback (Hairpin NAT / NAT Reflection) This configuration has been tested and approved for Gaia OS R76 / R77 and higher, but should work on lower Gaia OS versions, as well. This article describes how to set up NAT Loopback (also called Hairpin NAT, or NAT Reflection) on a Check Point Security Gateway.

How to host opencanvas 1.1