Alcatel Speed Touch Wireless, User Manual

Page: 242 / 362

13 Networking Services - Firewalling
242 / 362
3EC 17766 AAAA TCZZA Ed. 01
13.5 Firewalling and NAPT
NAT (Network Address Translation), is the translation of an IP
address used within one network to another IP address, known
within another network.
NAPT (Network Address and Port Translation) uses a combination
of IP addressing and port number mapping to create unique
combinations. That way, the STWireless can determine which
packet, sourced by the WAN, is destined to which device on your
local (W)LAN, and vice versa, without revealing the internal device
information towards the remote side.
The position of the Input, NAPT, Forward and Output logical
processing modules in the overall STWireless Firewall model is
relative to the traffic direction. In contrast, the STWireless 's WAN
and (W)LAN interfaces are physical" interfaces; their position is
not relative to the traffic direction.
The NAPT module is situated between the Forward and Output
hook (See STWireless Firewall model). Since the traffic direction
will determine input, and output, the NAPT module can always be
positioned between the Forward and Output module.
If you set rules on a hook, you should know if the packets that
pass through that hook contain IP addresses that are
NAPTĆtranslated or not.
If rules are set on the Output hook and NAPT is active, the IP
packets that pass that hook will contain translated IP addresses. If
you want to avoid certain traffic, by setting rules that filter on
certain (ranges of) IP addresses, you should be aware of the
location where the rule will be verified, since, depending on the
hook, another IP address will be seen by the Firewall.
As a conclusion: if NAPT is activated, the IP address that identifies
a local device, will be different depending on the direction of the
traffic.