NAT Configuration seems impossible

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

NAT Configuration seems impossible

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
NAT Configuration seems impossible
NAT Configuration seems impossible
2021-10-26 16:53:45
Model: ER7206 (TL-ER7206)  
Hardware Version: V1
Firmware Version:

I hope I'm missing the mark here, but I cannot seem to implement NAT on this router. I have been getting very frustrated by the lack of real information about how to do various things.

 

Here's what I want to do:

  Assign a connection from an external IP address to an internal IP address for a specific service.

  For example, I want all SMTP traffic aimed at IPaddress 79.9.120.12 sent to the server on address 10.1.200.12. All other incoming traffic to that external address should be firewalled by default, so connections looking for SSH or HTTP basically go into the bit bucket. (None of these addresses are real, by the way)

SMTP traffic sent to a different external address should be sent to a different internal address, as there are multiple servers handling similar traffic. My Internet connection has over a dozen IP addresses assigned to it.

 

From what the documentation seems to be telling me, NAT rules turn an internal address into an external address for outbound traffic, but don't seem to turn external addresses into internal addresses. Further, all traffic on a specific port at the external WAN interface will be sent to one internal server, regardless of the external address it lands on. I have three e-mail servers on my network, so I want SMTP traffic sent to the appropriate server based on the external IP address. Similarly, I have multiple web servers in my network, so I do not want all HTTP requests going to the same server.

 

Can anyone tell me how to accomplish these tasks? The documentation certainly doesn't seem to. I have configured several routers and firewalls in the past, and this is the strangest one I have run across.

 

Thanks

Norm

  1      
  1      
#1
Options
4 Reply
Re:NAT Configuration seems impossible
2021-10-28 03:28:40

@npowroz 

 

What about One-To-One NAT?

This FAQ is on the tplink website: https://www.tp-link.com/en/support/faq/2153/

Just striving to develop myself while helping others.
  0  
  0  
#2
Options
Re:NAT Configuration seems impossible
2021-11-12 14:05:03

@npowroz I'm having the same problem.

  0  
  0  
#3
Options
Re:NAT Configuration seems impossible
2022-01-04 21:38:56 - last edited 2022-01-05 05:05:06

@npowroz 

 

Same issue.

 

Tech support is terrible too; wasted over 4 hours over 3 sessions on the phone.  Their solution was to turn the DMZ option on the One-To-One NAT Rule.  LOL - of course that works.

 

11.22.33.10 port 80 >> 192.168.0.100 port 80

11.22.33.11 port 25 >> 192.168.0.110 port 25

11.22.33.11 port 80 >> 192.168.0.110 port 80

11.22.33.12 port 21 >> 192.168.0.120 port 21

11.22.33.12 port 443 >> 192.168.0.120 port 443

 

The problem is there is no way to create firewall rules to to let the packets inbound once the NAT rule has been applied.  It is either all or none.

 

data on 11.22.33.10:80 >>> [[R600]] sees NAT rule w/o DMZ, drops data

data on 11.22.33.10:80 >>> [[R600]] sees NAT rule w DMZ, passes data since in DMZ >>> 192.168.0.100:80

 

there should be a place to create FireWall rules; these rule should be applied after the NAT rules:

 

data on 11.22.33.10:80 >>> [[R600]] sees NAT rule w/o DMZ, check FW rules, find rule "Allow 192.168.0.100:80" >>> 192.168.0.100:80

 

This is basically how every other firewall I configured have worked.

 

  0  
  0  
#4
Options
Re:NAT Configuration seems impossible
2022-01-05 04:59:00 - last edited 2022-01-05 05:03:00

@npowroz 

 

OK, I setup a lab using a R600VPN since I didn't have a ER-7206 and got it working.  I stand corrected regarding the DMZ option.  I wish techs would have provided the second part regarding setting up the Access Control rules...

 

Route SMTP traffic on 79.9.120.100 to 10.1.200.12

 

  1. set up
    • IP Address
      • Name Internal_012
      • IP 10.1.200.12
    • IP Group
      • Name Group_Internal_012
      • Address Name Internal_012
         
  2. set up a One-to-One NAT
    • Original IP 10.1.200.12
    • Translated IP 79.9.120.100
    • DMZ Enabled      (YES enabled)
       
  3. set up a Access Control rules:
    • Server012_SMTP
      • Source IPGROUP_ANY
      • Destination Group_Internal_012
      • Policy Allow
      • Service Type SMTP
    • Server012_BlockALL
      • Source IPGROUP_ANY
      • Destination Group_Internal_012
      • Policy Block
      • Service Type ALL

 

 

 

 

  0  
  0  
#5
Options