Siemens RUGGEDCOM ROX II, User Manual

Page: 231 / 798

RUGGEDCOM ROX II
CLI User Guide
Chapter 6
Security
Network Address Translation 185
RUGGEDCOM ROX II implements an IP firewall using a structured user interface to configure iptables rules and
netfilter rulesets.
Section 6.9.1.3
Network Address Translation
Network Address Translation (NAT) enables a LAN to use one set of IP addresses for internal traffic and a second
set for external traffic. The netfilter NAT function makes all necessary IP address translations as traffic passes
between the Intranet and the Internet. NAT is often referred to in Linux as IP Masquerading.
NAT itself provides a type of firewall by hiding internal IP addresses. More importantly, NAT enables a network
to use more internal IP addresses. Since they are only used internally, there is no possibility of conflict with IP
addresses used by other organizations. Typically, an internal network is configured to use one or more of the
reserved address blocks described in RFC1918.
Table: RFC1918 Reserved IP Address Blocks
IP Network/Mask Address Range
10.0.0.0/8 10.0.0.0 – 10.255.255.255
172.16.0.0/12 172.16.0.0 – 172.31.255.255
192.168.0.0/16 192.168.0.0 – 192.168.255.255
When a packet from a host on the internal network reaches the NAT gateway, its source address and source TCP/
UDP port number are recorded. The address and port number is translated to the public IP address and an unused
port number on the public interface. When the Internet host replies to the internal host's packet, it is addressed
to the NAT gateway's external IP address at the translation port number. The NAT gateway searches its tables and
makes the opposite changes it made to the outgoing packet. NAT then forwards the reply packet to the internal
host.
Translation of ICMP packets happens in a similar fashion, but without the source port modification.
NAT can be used in static and dynamic modes. Static NAT (SNAT) masks the private IP addresses by translating
each internal address to a unique external address. Dynamic NAT translates all internal addresses to one or more
external addresses.
Section 6.9.1.4
Port Forwarding
Port forwarding, also known as redirection, allows traffic coming from the Internet to be sent to a host behind the
NAT gateway.
Previous examples have described the NAT process when connections are made from the Intranet to the Internet.
In those examples, addresses and ports were unambiguous.
When connections are attempted from the Internet to the Intranet, the NAT gateway will have multiple hosts
on the Intranet that could accept the connection. It needs additional information to identify the specific host to
accept the connection.
Suppose that two hosts, 192.168.1.10 and 192.168.1.20 are located behind a NAT gateway having a public
interface of 213.18.101.62. When a connection request for http port 80 arrives at 213.18.101.62, the NAT
gateway could forward the request to either of the hosts (or could accept it itself). Port forwarding configuration
could be used to redirect the requests to port 80 to the first host.