Multitech RouteFinder RF850 User Manual Download Page 96

Page: 96 / 194

Chapter 6 – RouteFinder Software

Multi-Tech Systems, Inc. RouteFinder RF850/860 User Guide (PN S000400E)

Network Setup > DNAT

DNAT

(Destination Network Address Translation) describes the target addresses of the IP packets for DNAT re-

routing. Use DNAT if you want to operate a private network behind your RouteFinder firewall and provide
network services that run only behind this private network available to the Internet. Note that for DNAT support,
the TCP and/or UDP settings must be enabled (see

Networks & Services > Services > Protocol

Important Notes:

•

You

cannot

add a DNAT rule with the Pre-DNAT Network as ANY, a Service as ANY, and a Destination

Service as ANY. If you do this, all the packets will be routed to the system with Post SNAT network, and
then the services in the firewall will not function properly.

•

The address conversion takes place BEFORE the filtering by the packet filter rules; therefore, you must
set the appropriate rules in the

Packet Filter > Rules

menu to let the already-translated packets pass.

You can find more about setting packet filter rules earlier in this chapter.

Add DNAT Definition

The DNAT screen contains four drop down list boxes. The first two define the original target of the
IP packets that are to be re-routed. The last two define the new target to which the packets are
forwarded. From the drop down list boxes, select IP packet characteristics to be translated.

Pre DNAT Destination

Select the original target Network/Host and the corresponding Service (e.g., FTP, FTP-
CONTROL) to be redirected.

Post DNAT Destination

Select a network/host to which the IP packets are to be diverted. Only one host can be
defined as the Post DNAT destination.

Important:

If you are using a port range as the Post DNAT Service, you must enter the

same Service definition as you entered in the Pre DNAT Service. In other words, you can
only map one port range to the same port range. Select a corresponding Service (e.g.,
DNS, FTP, FTP-CONTROL) to be redirected.

Add, Edit, Delete

Click the

Add

button to save your choices. After saving the settings, a table is created. You

can edit or delete entries by highlighting the desired entries and clicking

Edit

Delete

listed under

Command

DNAT Example

Your Internet/private network has the address range 192.168.0.0/255.255.255.0. Now, make a Web
server that is running on port 80 of server with the IP Address 92.168.0.20 accessible to clients
outside your LAN. These clients cannot contact its address directly, as the IP address is not routed
directly to the Internet. With DNAT, you can re-route port 80 on the RouteFinder’s external interface
onto the Web server.

Note:

To divert port 443 (HTTPS), you must change the value of the TCP port on the

Administration > Administrative Access

screen in the field

Administrative Access HTTPS Port

(e.g., port 444).

Examples of DNAT Network Combinations

You can map:

IP/Port

⇒

IP/Port

IP/Port-Range