Nat – how to setup sonicwall tz210 to port forward packets received from external ip to another external ip

I don't use Sonicwall but I doubt the user can specify at their end which WAN to use. You can probably set up a 1-to-1 outbound NAT for the user's IP (will want them to use a static IP) in the firewall to go out one or the other WAN though.

You can also probably set the Sonicwall to be in either Failover WAN mode (all outbound traffic routes out one of the WANs unless it goes down, then routes all traffic out the other) or Dual-WAN mode (traffic can go out of either WAN connection and the firewall arbitrarily chooses which one). You might try setting the Sonicwall up in Failover Mode and route all traffic out the Comcast connection, but this will affect ALL outbound traffic, not just certain users. If you want to pick and choose users, you will likely have to go the 1-to-1 NAT route...

This is in fact both possible and feasible. Here's how I set it up for OWA access to an Exchange server that's currently hosted but will eventually move onsite. Port 443 was already in use so this also involves shifting Exchange 2007's OWA to respond on 40443. I had originally planned to also remap from 40443 (in the real world) to 443 (internally & over VPN), but decided I was just asking for trouble.

In the Network/Address Objects area, defined an Address Object for the specific remote machine, RemoteExchange on 10.11.12.13/255.255.255.255 as a Host in the VPN Zone.

In the Network/Serices area, defined a service RemoteOWA40443 as TCP with start and end ports of 40443.

In the Network/NAT Policies area, created a policy with

• Source
  • Original: Any
  • Translated: Original
• Destination
  • Original: WAN Primary IP
  • Translated: RemoteExchange
• Service
  • Original: RemoteOWA40443
  • Translated: Original
• Interface
  • Inbound: Any
  • Outbound: Any

In the Firewall/Access Rules, added an Allow rule

• From Zone: WAN
• To Zone: VPN (we're using IPSEC, this might be SSLVPN for other sites)
• Service: RemoteOWA40443
• Source: Any
• Destination: Any
• Users Allowed: (up to you)
• Schedule: (up to you)
• Comment: Redirect Exchange OWA from our address to hosted server (Really, use these comment fields - you'll thank yourself when you're reviewing & maintaining)
• Enable Logging: Checked (I originally added multiple rules using All Zones for the From and To, then removed the rules with no traffic after I'd tested).

On the Exchange side this required changing the SSL port that it was listening on in the IIS Admin properties for the Default web site, setting the External host name for Outlook Anywhere, and setting the External URL for OWA to include the :40443.