D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 288 / 469

7.2. NAT Pools
Overview
As discussed in Section 7.1, “NAT”, NAT provides a way to have multiple internal clients and hosts
with unique private internal IP addresses communicate to remote hosts through a single external
public IP address. When multiple public external IP addresses are available then a NAT Pool object
can be used to allocate new connections across these public IP addresses.
NAT Pools are usually employed when there is a requirement for huge numbers of unique port
connections. The NetDefendOS Port Manager has a limit of approximately 65,000 connections for a
unique combination of source and destination IP addresses. Where large number of internal clients
are using applications such as file sharing software, very large numbers of ports can be required for
each client. The situation can be similarly demanding if a large number of clients are accessing the
Internet through a proxy-server. The port number limitation is overcome by allocating extra external
IP addresses for Internet access and using NAT Pools to allocate new connections across them.
Types of NAT Pools
A NAT Pool can be one of three types, each allocating new connections in a different way:
• Stateful
• Stateless
• Fixed
These three types are discussed below.
Stateful NAT Pools
When the Stateful option is selected, NetDefendOS allocates a new connection to the external IP
address that currently has the least number of connections routed through it with the assumption that
it is the least loaded. NetDefendOS keeps a record in memory of all such connections. Subsequent
connections involving the same internal client/host will then use the same external IP address.
The advantage of the stateful approach is that it can balance connections across several external ISP
links while ensuring that an external host will always communicate back to the same IP address
which will be essential with protocols such as HTTP when cookies are involved. The disadvantage
is the extra memory required by NetDefendOS to track the usage in its state table and the small
processing overhead involved in processing a new connection.
To make sure that the state table does not contain dead entries for communications that are no
longer active, a State Keepalive time can be specified. This time is the number of seconds of
inactivity that must occur before a state in the state table is removed. After this period NetDefendOS
assumes no more communication will originate from the associated internal host. Once the state is
removed then subsequent communication from the host will result in a new state table entry and
may be allocated to a different external IP address in the NAT Pool.
The state table itself takes up memory so it is possible to limit its size using the Max States value in
a NAT Pool object. The state table is not allocated all at once but is incremented in size as needed.
One entry in the state table tracks all the connections for a single host behind the D-Link Firewall no
matter which external host the connection concerns. If Max States is reached then an existing state
with the longest idle time is replaced. If all states in the table is active then the new connection is
dropped. As a rule of thumb, the Max States value should be at least the number of local hosts or
clients that will connect to the Internet.
There is only one state table per NAT Pool so that if a single NAT Pool is re-used in multiple NAT
IP rules they share the same state table.
7.2. NAT Pools Chapter 7. Address Translation
288