The PhoneBoy Blog

Simplifying Telecom, Mobile Phones, Gadgets, Health, and More!

FireWall-1 FAQ: Can't Get to a Translated Address from a Non-Firewalled Host

Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.

I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.

If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)


I have address translation working, but I’ve got a particular node that I can’t seem to get talking to a node on the Internal network that is being address translated. Here is my network configuration:

    1st Client        FireWalled Gateway               Router
    ( <------>le0           qe0   <------->(<--------> WAN
                 | (  ( |                       serial
    2nd Client   |                             |
    ( <--           (<--

My NAT rules look like this:

     No. |  From Original  |   To Original   |   Method        |   First Translated
         |  Address(Port)  |   Address(Port) |                 |   Address(Port)
     0   |       |        | FWXT_SRC_STATIC |
     1   |  |  | FWXT_DST_STATIC |

My routing tables on the firewall look like:

    Destination        Gateway        Flags    Ref   Use    Interface
    -----------------------------------------------------------------------------        UH       0      1450   lo0         UGH      0        6    U        3        27   le0          U        2        6    qe0    U        3        0    le0
    default    UG       0        25

On the first machine, the routing table looks like:

    Destination        Gateway        Flags     Ref     Use     Interface
    -----------------------------------------------------------------------------        UH       0       196     lo0          U        3         5     le0         U        3         0     le0
    default           UG       0        19

The Cisco Router has the following lines in it’s configuration:

    # show conf
    ip route
    ip route

I can ping in both direction between hosts on my WAN and, but I can’t ping from a host outside the firewall at What am I missing here?


From the “near” side of the firewall, all traffic goes to the WAN okay because routing is functioning okay at the gateway and the internal nodes know how to get traffic there. The traffic coming back from the WAN must go thru the router, which knows how to get traffic back to those translated address (thanks to the static host routes).

What has not been addressed here is the machines between the firewall and the WAN router. When wants to send a packet to (one of your translated addresses), it needs to know where to go. Because .80 and .90 are on the same subnet (logically), .80 sends out an ARP request (“Who is”) looking for a MAC address to send to. Nothing is answering this request, so it fails.

What you should be doing instead of the static host routes on the router is “Proxy ARPs” on your firewall machine. See Routing and ARP Issues with NAT for more details.

#Cybersecurity Evangelist, Podcaster, #noagenda Producer, Frequenter of shiny metal tubes, Expressor of personal opinions, and of course, a coffee achiever.