2

I'd like to think I have a good understanding of NAT and Firewall rules at a basic level, though please correct me if I'm wrong at any point. I've seen many products list their firewall requirements as needing ports allowed 'both ways'.

In particular I'm talking about the requirements listed here; http://mysignageportal.com/cdms/support/faq/what-information-do-i-need-if-there-are-restrictions-in-place-on-my-network.html

It states:

The following ports are required to be open both ways for complete communication with the CMS server

I understand allowing the ports outbound from our LAN to WAN on the firewall. However when it states both ways - wouldn't that require NAT on our WAN IP pointed to the LAN IP on the ports listed? The idea is to have many of these devices in our LAN so not sure how a 1:1 NAT rule could work there. I don't think they mean NAT, but need to be sure I'm not missing something here.

Would you say it's just their documentation that's lacking?
Does it just mean to allow it on the established connection when the LAN device sends traffic outbound? If so I've never seen a firewall rule to disallow an inbound response to an established connection.

Improve this question

1 Answer 1

Reset to default
2

By default, a firewall will block all outside-originated traffic. To allow a device outside the firewall to originate traffic to a device inside the firewall, you must create a firewall rule allowing that.

If so I've never seen a firewall rule to disallow an inbound response to an established connection.

What the documentation is explaining is that a device outside the firewall needs to originate traffic to your inside device, even without an established connection. That requires you to create a rule in the firewall to allow that.

The firewall rules are independent of NAT. If you have a NAT process running on the firewall, then you also need to forward a port on NAT to the appropriate inside server. Firewalls are often a convenient place to run NAT, but NAT really isn't a firewall function.

Improve this answer
6
  • We're using a Sonicwall and by default it will create a NAT rule from the LAN to WAN Interface for outbound traffic. That being the case, are you saying we'd need to create an inbound NAT rule on the WAN interface pointing to the LAN device on those ports? I understand we'll need firewall rules as well in that setup. What I struggle to then understand is how we can have multiple LAN devices in a setup with one WAN IP, can you explain how I can achieve that?
    – Huckleberry Finn
    Sep 20, 2018 at 14:04
  • 1
    If you have multiple devices with the same service, needing the same ports forwarded, then you have a problem. You have run into a weakness of NAT, and you probably need to get multiple public addresses. You can only forward a single protocol/port to a single inside device. IP was designed to have every host with a unique address, and NAT breaks that. If you have not yet implemented IPv6, it is past time to do that, and you can have every device with a unique address, restoring the IP paradigm. Otherwise, you may need to pay for more public IPv4 addresses, which are getting scarce.
    – Ron Maupin ♦
    Sep 20, 2018 at 14:08
  • Understood, I thought that would be the case. I was unsure because for the devices I'm trying to allow it seems a bit insane to have an IPv4 WAN IP for each. Thanks for the answer Ron!
    – Huckleberry Finn
    Sep 20, 2018 at 14:14
  • I beg to disagree here, but I am willing to stand corrected if this turns out otherwise. I agree that the document can be read that way, but usually the authors mean "outbound plus return packets", because someone somewhen explained a packet filter (and not a stateful firewall) to them. My experience with these "both ways" statements in documentation is: as good as never correct. Start with implementing the suitable outbound rules and see what happens (watch the FW log for drops of incoming connection attempts to these ports).
    – Marc 'netztier' Luethi
    Sep 20, 2018 at 15:35
  • To me, the tell-tale signs of limited knowledge in the document are: 1) referring to "Multicast" for local sync, within the context of firewall and internet and the remote CMS server. Multicast. Internet. My kind of humour. 2) Mentioning that a proxy server can be configured on the signage device to access the internet. As if a bread and butter proxy would ever allow reverse/incoming connections.
    – Marc 'netztier' Luethi
    Sep 20, 2018 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.