NAT Multiple External IPs to one DMZ IP

[runcmd]

We have multiple external facing IP addresses that we would like to NAT to a single DMZ IP address. For example:

1.0.0.1 - 1.0.0.20 (External) : NAT to : 172.16.0.30 (DMZ)

What I want to accomplish is: Traffic to any IP between 1.0.0.1 and 1.0.0.20 is NAT'ed to the single 172.16.0.30 address.

Is there an easy way this can be done?... Is it possible to specify a range when configuring NAT on a node? If not, can I just create multiple nodes with the same DMZ IP and then NAT each one to a different external IP address? Thanks in advance for any and all responses!

[Sergej]

I'm not sure this is supported. But you can try (you second option) and provide the feedback here.

[dsb.nepo]

Maybe you can do the following trick
- add ipalias from 172.20.0.31-39 to the machine (so the machine takes 10 IP's)
- create 10 external and 10 internal objects
- handle every ip pair as own (arp/route/nat ...)

If you have only on application look with lsof, sockstat, netstat or whatever the system have if the application listen to *:PORT.

I do this with some application server without problem

[runcmd]

If you try to create two nodes with the same IP, but different NATs, you encounter the following error when you attempt to publish:

Policy: Advanced Security
Status: Error
Node1 and Node2 have the same IP address and both have network address translation

[Tetaworx]

Originally Posted by runcmd

[...]
What I want to accomplish is: Traffic to any IP between 1.0.0.1 and 1.0.0.20 is NAT'ed to the single 172.16.0.30 address.
[...]

You can only achieve this with manual NAT rules, I think.

Create a network objekt for every of the twenty external natted IP's and use them as the original packet destination of the manual NAT rule. As the translated packet destination use the internal network object with your IP 172.16.0.30.

If this is the first manual NAT rule in your rule base take care of "Global Properties -> NAT -> Manual NAT rules -> Translate destination on client side".

If external connections should be initiated inside->out from 172.16.0.30 to the internet you need a manual hide nat, too.

-Dennis