Access list, SOURCE NAT and DEST NAT
U
SER
G
UIDE
165
set source-nat
allows to modify the source address of the packets belonging to a specified data flow. Usually this
operation is used to change the private source address with a public one. The packet flow is identify
by one of the following parameters:
protocol
source address or subnet
source port
recipient address or subnet
output interface
The command appears in the following ways
set source-nat protocol PROT from ADDRESS to ADDRESS out-interface INTF source-ip ADDRESS
set source-nat protocol PROT from ADDRESS to ADDRESS out-interface INTF source-subnet ADDRESS
set source-nat protocol PROT from ADDRESS source-port PORT to ADDRESS dest-port PORT out-interface INTF source-ip ADDRESS
set source-nat protocol PROT from ADDRESS/L source-port PORT to ADDRESS dest-port PORT out-interface INTF source-subnet ADDRESS/L
where:
PROTOCOL
tells the protocol type, that can be:
TCP
UDP
ICMP
GRE
OSPF
L2TPV3
ANY
ADDRESS
can be a network prefix (
10.10.10.0/24
) or the keyword
any
(to point any
address) or the keyword
this
(to point any address of the router itself)
PORT
is a numeric value that identify the UDP or TCP port, or a string that identify the
service (Telnet, SSH, SNMP,...) or the keyword
any
.
The argument
out-interface
can be omitted and in this case you refer to any network interface:
the
source-nat
operation is applied regardless of the interface on which the packet must be sent.
The argument
source-ip
tells the address to be used for the
source-nat
operation, i.e. the
address which replaces the source address of the IP packet, before being transmitted over the
network.
If the option
source-subnet
is specified instead of
source-ip
, the argument must necessarily be
a network-prefix for both
source-subnet
and
from
. For example, with:
set source-nat protocol any from 10.10.1.0/24 to any source-subnet 8.1.10.0/24
you mean that:
the packets from the
10.10.1.1
local address will be sent with the IP source
8.1.10.1
,
the packets from the
10.10.1.2
local address will be sent with the IP source
8.1.10.2
,
the packets from the
10.10.1.3
local address will be sent with the IP source
8.1.10.3
,
and so on.
