Reply
Ubiquiti Employee
Posts: 3,982
Registered: ‎08-08-2016
Kudos: 3812
Solutions: 300

Re: Guide to disabling NAT on USG


buggy10 wrote:
Sorry, confusing stuff. Correction:
The wan port of the USG is 10.11.0.40, the lan port 10.11.40.1.

To elaborate now that I see the specific IPs here, the Juniper needs a static route for 10.11.40.0/24 pointing to 10.11.0.40. 

New Member
Posts: 7
Registered: ‎12-04-2017

Re: Guide to disabling NAT on USG

[ Edited ]

Hi,

thanks for all your posts. Finally I this working except port forwarding.

I see all my client in the USG and DPI is working great. The DHCP is running on the USG. I created a static rout in the Router. But I have to forward a few ports for services I need outside my home.

 

I dont see any devices exept the USG in my Router. So cant foward there. I have to forward in the USG but its not working. How can I do this?

 

My Config

 

 

Router LAN ------> USG WAN  --------->USG LAN        ------> LAN Switch

192.168.1.1------->192.168.1.3--------- >192.168.2.200------> 192.168.2.x

 

I want to forward 192.168.2.25 with port xxx. Please help

 

 

Edit:

Ok I can forward a port, if I set the port in the Router and in the USG.

BUT: Is it not that what you want to prevent by disabling NAT? I'm confused :-(Mad2

 

Established Member
Posts: 1,312
Registered: ‎10-15-2015
Kudos: 408
Solutions: 63

Re: Guide to disabling NAT on USG

No NAT != No firewall. Need to disable the default WAN rules.

New Member
Posts: 7
Registered: ‎12-04-2017

Re: Guide to disabling NAT on USG

Thx for reply, 

 

you mean I have to delete the WAN Firewall rules?

 

How is this possible? I cant edit any of my rules. They are all greyed out. Not possible to click.Bildschirmfoto 2017-12-05 um 20.21.50.png

Established Member
Posts: 1,312
Registered: ‎10-15-2015
Kudos: 408
Solutions: 63

Re: Guide to disabling NAT on USG

Perhaps they can be overridden with config.gateway.json
Emerging Member
Posts: 45
Registered: ‎08-23-2017
Solutions: 1

Re: Guide to disabling NAT on USG

HI,

Dont mean to hijak but.....

Hi,

I have succesfully set up an Edgerouter X to load balance two wans and pass through to wan1 of a USG.

BUT I need to be able to have the USG handle port forwarding and vpn, etc...

What and how do I configure the Edgerouter X

Thanks

New Member
Posts: 2
Registered: ‎12-09-2017
Kudos: 2

Re: Guide to disabling NAT on USG

Love to hear the answer on Transparent Bridge Mode.  I purchased the USG for DPI.  But right now it is a brick.  I have 4 vlans (2 are pvlans) and a management lan.  Frontending a firewall with a router and creating "transport" ip ranges for the vlans seems ... error prone.  Not to mention how to get the different VPNs on my Fortinet that need direct layer 2 connection to the vlans.  All seems like a hack.  The solution is simple - Bump in the wire - Transparent Bridge Mode. 

 

Don't get me wrong.  I like Ubiquiti. Well I wish the unifi products had the features of the edgeswitchs (like pvlans).  But the APs are outstanding and the point to multipoint options for campus connections work well. The USG has the potential as a simple DPI box.  Like to see it go that direction.

Emerging Member
Posts: 78
Registered: ‎05-01-2016
Kudos: 8
Solutions: 2

Re: Guide to disabling NAT on USG

My currnet config:

 

Internet -> pfSense WAN -> fpSense LAN -> Cisco 3650G PS switch. 

 

My pfSense has HAProxy enabled because I host several websites. So if a USG Pro inbetween the Internet and pfSense WAN and disable NAT will the internet traffic still be able to get to my web servers?

 

Would doing it this way work?

Internet -> USG PRO WAN -> USG PRO LAN -> pfSense WAN -> pfSense LAN -> Cisco 3650G PS swtich. - or am I looking at this wrong?

 

Thanks,

 

Highlighted
New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

Hi, 

 

I also have a Sophos UTM in front of the USG.

 

Can someone please tell me how to set the static route on the UTM.

 

regards

New Member
Posts: 7
Registered: ‎11-07-2016
Kudos: 1

Re: Guide to disabling NAT on USG

Hi @Honzfonz

 

There are two steps and one simple extra check, as I describe here: https://community.ubnt.com/t5/UniFi-Routing-Switching/Guide-to-disabling-NAT-on-USG/m-p/2057754/high...

 

1) Add the USG internal network(s) to "Network Protection" -> "Firewall" as the source for all outgoing rules
2) Add the USG internal network(s) to the "Network Protection" -> "NAT" masqerading sources
3) Make sure the USG internal networks are NOT assigned the the UTM already: "Interfaces & Routing" -> "Interfaces" -> "Additional Addresses"

 

And be sure that the USG and the UTM does not use the same network addresses, that will leave everything confused.

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

Thanks for your answer, I´ll give it another try

 

But one more question:

 

Is it possibe to set it like: Fritzbox 192.168.0.1 - Sophos UTM 192.168.1.100 - Unifi USG 192.168.2.1 and then back to internal LAN 192.168.1.0/24?

 

and do I need a static route on the USG controller?

 

thanks

New Member
Posts: 7
Registered: ‎11-07-2016
Kudos: 1

Re: Guide to disabling NAT on USG

[ Edited ]

Short answer: no, that would mess up completely.

Long answer:
When you set up the USG without NAT you still use it to distribute ip addresses and it still will route traffic just not via NAT, so there must be (an even greater) separation of network addresses than before NAT.

Fritzbox LAN ------> UTM WAN --------->UTM LAN ---------> USG WAN --------->USG LAN ------> LAN device
192.168.0.1------->192.168.0.2--------- >192.168.2.1------> 192.168.2.1--------- >192.168.1.1------> 192.168.1.x

 To your other question, yes a static route should be set on the USG, it should route the UTM LAN network to the WAN interface of the USG.

staticroute.png

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

Thank you!

 

Now I need weekend

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

Last questions^^

 

what did you set in the "Router" field from WAN1 of the USG?

 

Is it the UTM Lan address?

 

regards

New Member
Posts: 7
Registered: ‎11-07-2016
Kudos: 1

Re: Guide to disabling NAT on USG

Yes:

router.png

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

Thank you very much for your quick help!

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

[ Edited ]

do not get it work

 

My rule under "Network Protection" -> "NAT" masqerading looks like:

 

 External WAN is the WAN address from the Sophos UTM.

 

 Is this enaugh?

 

 

nat.PNG

New Member
Posts: 7
Registered: ‎11-07-2016
Kudos: 1

Re: Guide to disabling NAT on USG

I think that will work, I have "All internal networks" a group that consists of the USG LAN and the UTM LAN networks instead of the Any.

 

The reason it is not working for you is because I have forgotten to say that you need the static route (obviously) sorry about that:

Staticroute.png

 

I should probably do a complete writeup of this thing

New Member
Posts: 12
Registered: ‎04-21-2016

Re: Guide to disabling NAT on USG

[ Edited ]

Added the static route - still no luck.

 

Anything else you might have forgotten? ;-)

 

 

Reply