1

I have Juniper SRX300. Due to some restrictions, i can't use static WAN IP address. I need to port forward a range of ports and it's working only using nat static section like this:

username# show security nat static rule-set FORWARD
from zone untrust;
rule RANGE1 {
    match {
        destination-address 1.2.3.4/32;
        destination-port 20001 to 21000;
    }
    then {
        static-nat {
            prefix {
                10.1.2.3/32;
                mapped-port 20001 to 21000;
            }
        }
    }
}

But sometimes pppoe connection to my provider restarts due to a power failure and each time i get new WAN IP address i need to manually configure

set security nat static rule-set FORWARD rule RANGE1 match destination-address 1.2.3.4/32

I also tried specifying

set security nat static rule-set FORWARD rule RANGE1 match destination-address 0.0.0.0/32;

but that doesn't work either.

Port forward with range of ports using nat destination doesn't work.

Configuration of nat destination i tried:

username# show security nat destination
pool LOCALSERVER {
    address 10.1.2.3/32;
}
rule-set DNAT-FORWARD {
    from zone untrust;
    rule RANGE {
        match {
            destination-address 0.0.0.0/0;
            destination-port {
                20001 to 21000;
            }
        }
        then {
            destination-nat {
                pool {
                    LOCALSERVER ;
                }
            }
        }
    }

And i can't specify a range of ports for security nat destination pool, so this configuration doesn't work.

What configuration i can use so it will work without a need for me to specify anything?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 3:29

1 Answer 1

1

You where very very close... you should use 0.0.0.0/0 not 0.0.0.0/32.

1
  • You can't do that because "match destination address" netmask and "then static-nat prefix" netmask must be the same
    – Nufay
    May 28, 2019 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.