D-Link NetDefend DFL-1660, User Manual

Page: 383 / 595

• The reply arrives and both address translations are restored:
195.55.66.77:80 => 10.0.0.3:1038
In this way, the reply arrives at PC1 from the expected address.
Another possible solution to this problem is to allow internal clients to speak directly to 10.0.0.2 and this would
completely avoid all the problems associated with address translation. However, this is not always practical.
7.4.2. Translation of Multiple IP Addresses (M:N)
A single SAT rule can be used to translate an entire range of IP addresses. In this case, the result is a
transposition where the first original IP address will be translated to the first IP address in the
translation list and so on.
For instance, a SAT policy specifying that connections to the 194.1.2.16/29 network should be
translated to 192.168.0.50 will result in transpositions which are described in the table below:
Original Address Translated Address
194.1.2.16 192.168.0.50
194.1.2.17 192.168.0.51
194.1.2.18 192.168.0.52
194.1.2.19 192.168.0.53
194.1.2.20 192.168.0.54
194.1.2.21 192.168.0.55
194.1.2.22 192.168.0.56
194.1.2.23 192.168.0.57
In other words:
• Attempts to communicate with 194.1.2.16 will result in a connection to 192.168.0.50.
• Attempts to communicate with 194.1.2.22 will result in a connection to 192.168.0.56.
An example of when this is useful is when having several protected servers in a DMZ, and where
each server should be accessible using a unique public IPv4 address.
Example 7.5. Translating Traffic to Multiple Protected Web Servers
In this example, a SAT IP rule will translate from five public IPv4 addresses to five web servers located in a DMZ.
The firewall is connected to the Internet via the wan interface and the public IPv4 addresses are the range
195.55.66.77 to 195.55.66.81. The web servers have the private IPv4 address range 10.10.10.5 to 10.10.10.9
and are on the network connected to the dmz interface.
The following steps need to be performed:
• Define an address object containing the public IPv4 addresses.
• Define another address object for the base of the web server IP addresses.
• Publish the public IPv4 addresses on the wan interface using the ARP publish mechanism.
• Create a SAT rule that will perform the translation.
• Create an Allow rule that will permit the incoming HTTP connections.
Since the five public IPv4 addresses are being ARP published so these addresses are not routed on core, the
SAT destination interface is wan and not core.
7.4.2. Translation of Multiple IP
Addresses (M:N) Chapter 7. Address Translation
383