[FW1] FW: How to NAT (both ports and adresses...?) - Additional Info..

["METE EMINAGAOGLU (IT)" <mete.e@FW1-NOSPAMdigiturk.net>]

Title: FW: How to NAT (both ports and adresses...?) - Additional Info..

Oh, by the way, let me clarify one important thing also...

We cannot change the application software, service settings, etc. on none of the 60.x.x.x or 192.168.x.x. Both servers listen on TCP_1900.

I mean, 60.x.x.x is to send packets from TCP_1900, meanwhile 192.168.x.x must receive packets again on TCP_1900.
(Otherwise, the problem and the solution would have been trivial...)

 -----Original Message-----
From:   METE EMINAGAOGLU (IT) 
Sent:   Wednesday, August 15, 2001 11:14 PM
To:     'fw-1-mailinglist@beethoven.us.checkpoint.com'
Subject:        How to NAT (both ports and adresses...?)

Hi to all...

I have a bit of complex and perhaps weird problem, hence question. Any help, comment, suggestion is welcome. Thanx.

Problem:

A Server in my DMZ. Let's say 60.x.x.x
Another Server in my LAN. Let's say 192.168.x.x
A specific service on Real Port k. Let's say TCP_1900

The original rule setting:

Source:60.x.x.x
Destin: 192.168.x.x
Service: TCP_port_1900.

Everythg. works fine.

However, I want a new arrangement so that TCP_1900 packets do not directly go from 60.x.x.x to 192.168.x.x. They are to be routed to any non-existent fake X-Server via a different NAT' ed fake port, say TCP_fake. Then, from X-Server to the target destin. 192.168.x.x in LAN,  while also fake-port NAT' ed to the real TCP_1900.

Using only a single FW, how could this be achieved? (What are the necessary rules and IP+service NAT' s?)

If not possible by a single FW, then what is additionally required within the FW so as to establish the necessary solution?

Mete EMINAGAOGLU