Inbound Rule to entire inside subnet

[Scott_Sassin]

I'm having difficulty creating an inbound rule, that will allow one outside address to initiate communication with any host in one or many of the local subnets. 

For example, permit (outside interface source)  20.25.25.16 to (Inside Destination) 10.190.0.0/16, (ports 80,443,8018,8008).

[CptnCrnch]

It’s kinda clearly explained on https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Using_Layer_3_Firewa...

[Scott_Sassin]

Thanks for the reply. 

The link you posted, shows outbound connections.

I need to allow an inbound connection, coming in from the internet interface, from one source address, to be able to reach all hosts on the inside network, on certain ports.

[jdsilva]

Hey @Scott_Sassin,

You just hit on a use case that is not truly supported by the MX. In order to do this you'd have to create either individual port forwards, or 1:1/1:Many NAT entries for every inside host... Or more likely a combination of all three of these. None of those are good options for you, or going to actually be manageable. Sorry 😞

[DarrenOC]

Hi @Scott_Sassin , the link that @CptnCrnch provided is correct.  Outbound rules are also treated as Inbound rules:

 

So if you specify your internal subnet/s and ports as the source and then the external IP and ports as the destination 

[KarstenI]

The most "typical" (and probably best) solution is to VPN into the network and access the hosts transparently.

[writ_er_relo]

"The inbound firewall will deny any traffic that does not have a session initiated by a client behind the MX. This allows internal client machines to connect with any resources they need, but does not let outside devices initiate connections with inside client machines. The exception to this is if a Port Forward or 1:1 NAT is created. "

Source:

https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Blocking_Inbound_Traffic_on_MX_Security_...

But, I can't think of a design where the original request would be fulfilled. You'd need to NAT, or port forward every client.

In your original question: how would the outside IP know how to differentiate between internal clients from the outside?