D-Link NetDefendOS, User Manual

Page: 600 / 912

connection to the web server's private address - port 1084.
If the Service was changed so that only the single value 80 was specified for is Port property then
the SAT rule would only trigger for port 80 and it would always be translated to the new port
1080 (a one-to-one relationship)
7.4.6. SAT with FwdFast Rules
It is possible to SAT IP rules in conjunction with FwdFast IP rules. In other words, to use SAT with
stateless connections. The difference in this case is that the return traffic must be explicitly
translated and allowed by separate
FwdFast IP rules.
The following table shows the correct configuration of SAT rules with FwdFast rules for
connections to a web server with the private IP address wwwsrv located on an internal network:
# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action
1 SAT any all-nets core wan_ip http-all Destination IP: wwwsrv
2 SAT lan wwwsrv any all-nets http-all Source IP: wan_ip
3 FwdFast any all-nets core wan_ip http-all
4 FwdFast lan wwwsrv any all-nets http-all
Suppose now, that access to the public Internet by clients on the internal network lan_net is
required. The following NAT rule might be added after the other rules by the administrator:
# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action
5 NAT lan lan_net any all-nets all_services
However, this is not correct. What will happen with this additional rule is the following:
• External traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv . This is correct.
• Return traffic from wwwsrv will match rules 2 and 4, and will appear to be sent from
wan_ip:80 . This is correct.
• Internal traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv . This is almost
correct; the packets will arrive at wwwsrv , but:
• Return traffic from wwwsrv to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.
The administrator might try moving the NAT IP rule to between the SAT and FwdFast rules as
shown below:
# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action
1 SAT any all-nets core wan_ip http-all Destination IP: wwwsrv
2 SAT lan wwwsrv any all-nets http-all Source IP: wan_ip
3 NAT lan lan_net any all-nets all_services
4 FwdFast any all-nets core wan_ip http-all
5 FwdFast lan wwwsrv any all-nets http-all
This will still not be correct since the following will happen:
• External traffic to wan_ip will match rules 1 and 4, and will be sent to wwwsrv . This is correct.
Chapter 7: Address Translation
600