50
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
3. Apply the destination NAT rule-set to the public interface.
Following example describes the step-by-step configuration of an example destination NAT rule-set to per-
form port forwarding for incoming Modbus protocol (TCP port 512) traffic on the cellular interface to the
private HOST-1 (assume that modbus traffic is running on port 5512 on HOST-1). Change to CLI config-
uration mode:
1. Enable firewall service, if it is not already enabled.
admin@(none) 19:33:20% set services firewall enabled true
2. Create source NAT rule-set named IO_SERVICES.
admin@(none) 19:33:20% set services firewall nat destination rule-set IO_SERVICES
3. Create rule for port forwarding Modbus TCP traffic coming into cellular interface on port 512 to
port 5512 on private HOST-1.
admin@(none) 19:33:20% set services firewall nat destination rule-set IO_SERVICES rule 1 match pro-
tocol tcp dst-address 10.150.1.1/32 dst-port 512
admin@(none) 19:33:20% set services firewall nat destination rule-set IO_SERVICES rule 1 destina-
tion-nat address 192.168.1.1 port 5512
4. Apply this destination NAT rule-set to cellular interface.
admin@(none) 19:33:20% set interfaces eth1 nat destination IO_SERVICES
5. Commit configuration and exit configuration mode.
admin@(none) 19:33:20% commit
admin@(none) 19:33:20% exit
admin@(none) 19:33:20>
Monitoring
At this time there are no commands to monitor traffic statistics for packets being masqueraded by the
firewall. This feature may be added in future revisions of firmware.
