Chapter 4 – Troubleshooting
Multi-Tech RouteFinder RF650VPN User Guide
164
Q14: Can I forward SSH connects?
A14: Yes, by configuring port forwarding of SSH (dest.port 22):
Source: External Interface Port 22 goes to
Destination: SSH_Server Port 22
Procedure:
1. Define two Hosts in Definition|Networks:
external_NIC a.b.c.d 255.255.255.255
SSH_Server e.f.g.h 255.255.255.255
2. Define one Service in Definition|Services:
NAT_SSH TCP 0:65534 22
3. Add one NAT-Rule in Network | NAT: external_NIC NAT_SSH -> SSH_Server NAT_SSH.
4. Add one Rule in Packet Filer | Rules: Any NAT_SSH SSH_Server Allow.
This way, the destination address of every tcp packet will be translated from a.b.c.d:22 (Firewall) to
e.f.g.h:22 (SSH-Server) and back again.
Q15: SNAT: what is it and what would I use it for?
A15: SNAT is similar to Masquerading.
Definition SNAT (DSNAT): With SNAT you can rewrite the original Source Address of a specific IP
connection with another static IP address.
You must make sure that the answer comes back to the firewall (e.g., if you want to access a Cisco
router via telnet and the RouteFinder only allows connects from a specific static IP address, you
can specify this in Source NAT.
Define a rule like: AdminPC, Telnet, Cisco Router -> Allowed Cisco IP.
Now you can communicate with the Router. This is needed for more complex configurations.
Q16: How do I set up RouteFinder Masquerading?
A16: Configure Masquerading in WebAdmin:
1. Define
Interfaces
in
Network | Interfaces. Here you define your Network Interface settings as
well as your default gateway, for example:
Internal: 192.168.100.1/255.255.255.255
External: 194.162.134.10/255.255.255.128
Gateway: 194.162.134.1/255.255.255.128
2.
Define Network definitions in Definitions | Networks. Here you define your host and network
definitions, which you will use for further configuration like Masquerading or Packet Filter Rules
later on (i.e., Internal-Network 192.168.100.0 255.255.255.0 / Peters-Laptop 192.168.100.12
255.255.255.255).
3. Define
Masquerading
in
Network | Masquerading. Here you define which network should be
masqueraded on which network interface (i.e., Internal-Network | External).
4. Define Packet filter Rules and Proxy Settings. Now you have set your Security Policy in
terms of what is allowed and what is not allowed. The RouteFinder uses stateful inspection,
so you only have to define which services are allowed; the way back is opened automatically
(e.g., Internal-Network - FTP - Any - Allowed | Peters-Laptop - Telnet - Any -
Allowed).
If you want to use the Proxies you can configure them in WebAdmin | Proxies.
Q17: Can I do DNAT with Port ranges?
A17: Yes. Mapping DNAT port ranges is supported, with the limitation that you can only map the same
range (so, for example, you can map ports 500-600 to 500-600 but not 500-600 to 300-400).
Q18: Does NAT take place before or after routing and filtering take place?
A18: In short, DNAT is done before the packets pass the packet filter, and SNAT and Masquerading are
done after that. The RouteFinder uses a 2.4 kernel and iptables (the internal logic in the netfilter
code).
