#
Action
Src Iface
Src Net
Dest Iface
Dest Net
Parameters
2
Allow
any
all-nets
core
wan_ip
http
These two rules allow us to access the web server via the NetDefend Firewall's external IP address. Rule 1 states
that address translation can take place if the connection has been permitted, and rule 2 permits the connection.
Of course, we also need a rule that allows internal machines to be dynamically address translated to the Internet.
In this example, we use a rule that permits everything from the internal network to access the Internet via NAT
hide:
#
Action
Src Iface
Src Net
Dest Iface
Dest Net
Parameters
3
NAT
lan
lannet
core
wan_ip
All
The problem with this rule set is that it will not work at all for traffic from the internal network.
In order to illustrate exactly what happens, we use the following IP addresses:
•
wan_ip (195.55.66.77): a public IP address
•
lan_ip (10.0.0.1): the NetDefend Firewall's private internal IP address
•
wwwsrv (10.0.0.2): the web servers private IP address
•
PC1 (10.0.0.3): a machine with a private IP address
The order of events is as follows:
•
PC1 sends a packet to wan_ip to reach www.ourcompany.com:
10.0.0.3:1038 => 195.55.66.77:80
•
NetDefendOS translates the address in accordance with rule 1 and forwards the packet in accordance with
rule 2:
10.0.0.3:1038 => 10.0.0.2:80
•
wwwsrv processes the packet and replies:
10.0.0.2:80 => 10.0.0.3:1038
This reply arrives directly to PC1 without passing through the NetDefend Firewall. This causes problems.
The reason this will not work is because PC1 expects a reply from 195.55.66.77:80 and not 10.0.0.2:80. The
unexpected reply is discarded and PC1 continues to wait for a response from 195.55.66.77:80 which will never
arrive.
Making a minor change to the rule set in the same way as described above, will solve the problem. In this
example, for no particular reason, we choose to use option 2:
#
Action
Src Iface
Src Net
Dest Iface
Dest Net
Parameters
1
SAT
any
all-nets
core
wan_ip
http SETDEST wwwsrv 80
2
NAT
lan
lannet
core
wan_ip
All
3
Allow
any
all-nets
core
wan_ip
http
•
PC1 sends a packet to wan_ip to reach "www.ourcompany.com":
10.0.0.3:1038 => 195.55.66.77:80
•
NetDefendOS address translates this statically in accordance with rule 1 and dynamically in accordance with
rule 2:
10.0.0.1:32789 => 10.0.0.2:80
•
wwwsrv processes the packet and replies:
10.0.0.2:80 => 10.0.0.1:32789
•
The reply arrives and both address translations are restored:
195.55.66.77:80 => 10.0.0.3:1038
In this way, the reply arrives at PC1 from the expected address.
7.4.1. Translation of a Single IP
Address (1:1)
Chapter 7. Address Translation
353
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
