Block all inbound traffic except for a defined IP

Question

Thanks in advance to anyone who will take time to provide a possible solution. This is my actual situation:

                               ___________________       ________________
INTERNET --------------------- |                 |-------|               |
                               | Main router     |       |  PC 1         |
                               | 192.168.10.254  |       | IP from DHCP  |
        -----------------------|_________________|       |_______________|
   _____|________________
   |                    |
   | Juniper netscreen  |
   | Untrusted interface|                UNTRUSTED ZONE
   | 192.168.10.95      |
   |--------------------|---------------------------------------------------
   | Trusted interface  |
   | 192.168.2.1        |                TRUSTED ZONE
   |____________________|
         |            |
   ______|__________  |       _____________________
   |               |  |______|                     |
   | PC 2          |         | Other PCs in the    |
   | 192.168.2.100 |         | 192.168.2.x range   |
   |_______________|         |_____________________|

I need to give Internet access to all the 192.168.2.x devices (.100 included), but to allow requests from the untrusted zone only to the PC with IP 192.168.2.100. I created some rules so that the 192.168.2.x devices (.100 included) now have Internet access, and I can also ping PC1.

The problem is that I cannot ping any 192.168.2.x device from PC1 exception made for the virtual router 192.168.2.1. I tried creating several routes but it didn't work. There surely is something I'm doing wrong.

The final goal is to allow only 192.168.2.100 to be reachable (and ping-able) from the untrusted zone, while still allowing Internet access in the whole trusted zone. I tried reading the Netscreen documentation, but I couldn't find anything useful.

The Juniper Netscreen model is NS-5GT with 5.4.0r3a.0 firmware.

Answer 1

Its seems that your NetScreen has its operational mode configured to route and NAT. In that case, you cannot access any computer in the trust zone by setting the destination IP as 192.168.2.X. In fact the 192.168.2.X net is unreachable from the untrusted interface.

In order to fullfill your requirements, you have to configure port forwarding on the NetScreen equipment (please see Juniper Knowledge Base).

Then you have to route the virtual IP to the untrusted interface on your main router, in order to allow PC 1 to reach the virtual IP