D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 295 / 469

Original Address Translated Address
194.1.2.22 192.168.0.56
194.1.2.23 192.168.0.57
In other words:
• Attempts to communicate with 194.1.2.16 will result in a connection to 192.168.0.50.
• Attempts to communicate with 194.1.2.22 will result in a connection to 192.168.0.56.
An example of when this is useful is when having several protected servers in a DMZ, and where
each server should be accessible using a unique public IP address.
Example 7.5. Translating Traffic to Multiple Protected Web Servers
In this example, we will create a SAT policy that will translate and allow connections from the Internet to five web
servers located in a DMZ. The D-Link Firewall is connected to the Internet using the wan interface, and the public
IP addresses to use are in the range of 195.55.66.77 to 195.55.66.81. The web servers have IP addresses in the
range 10.10.10.5 to 10.10.10.9, and they are reachable through the dmz interface.
To accomplish the task, the following steps need to be performed:
• Define an address object containing the public IP addresses.
• Define another address object for the base of the web server IP addresses.
• Publish the public IP addresses on the wan interface using the ARP publish mechanism.
• Create a SAT rule that will perform the translation.
• Create an Allow rule that will permit the incoming HTTP connections.
CLI
Create an address object for the public IP addresses:
gw-world:/> add Address IP4Address wwwsrv_pub Address=195.55.66.77-195.55.66.81
Now, create another object for the base of the web server IP addresses:
gw-world:/> add Address IP4Address wwwsrv_priv_base Address=10.10.10.5
Publish the public IP addresses on the wan interface using ARP publish. One ARP item is needed for every IP
address:
gw-world:/> add ARP Interface=wan IP=195.55.66.77 mode=Publish
Repeat this for all the five public IP addresses.
Next, change the current category to be the main IP rule set:
gw-world:/> cc IPRuleSet main
Next, create a SAT rule for the translation:
gw-world:/main> add IPRule Action=SAT Service=http SourceInterface=any
SourceNetwork=all-nets DestinationInterface=wan
DestinationNetwork=wwwsrv_pub SATTranslateToIP=wwwsrv_priv_base
SATTranslate=DestinationIP
Finally, create a corresponding Allow Rule:
gw-world:/main> add IPRule Action=Allow Service=http SourceInterface=any
SourceNetwork=all-nets DestinationInterface=wan
DestinationNetwork=wwwsrv_pub
Web Interface
7.3.2. Translation of Multiple IP
Addresses (M:N) Chapter 7. Address Translation
295