Access list, SOURCE NAT and DEST NAT
U
SER
G
UIDE
166
To perform the NAT operation more selectively and transmit, for example, the outbound RADIUS
packets on the
atm0
interface with the
10.0.0.1
address:
set source-nat protocol udp from any source-port any to any dest-port radius out-interface atm0 source-ip 10.0.0.1
To delete the
source-nat
rules:
set no-source-nat protocol any from 10.10.1.0/24 to any source-subnet 8.1.10.0/24
set no-source-nat protocol udp from any source-port any to any dest-port radius out-interface atm0 source-ip 10.0.0.1
D
ESTINATION
NAT
The command
set dest-nat
allows to modify the recipient address of the packets that belong to a specific data stream. Usually
this operation is done to replace the public recipient address with a private one. The packet flow is
identified by:
protocol
source address or subnet
source port
recipient address or subnet
input interface
The command is like:
set dest-nat protocol PROT from ADDRESS to ADDRESS in-interface INTF dest-ip ADDRESS
set dest-nat protocol PROT from ADDRESS to ADDRESS in-interface INTF dest-subnet ADDRESS
set dest-nat protocol PROT from ADDRESS source-port PORT to ADDRESS dest-port PORT in-interface INTF dest-ip ADDRESS
set dest-nat protocol PROT from ADDRESS/L dest-port PORT to ADDRESS dest-port PORT out-interface INTF dest-subnet ADDRESS/L
where:
PROTOCOL
can be:
o
TCP
o
UDP
o
ICMP
o
GRE
o
OSPF
o
L2TPV3
o
ANY
ADDRESS
can be a network prefix (
10.10.10.0/24
) or the keyword
any
(to point any
address) or the keyword
this
(to point any address of the router itself)
PORT
is a numeric value that identifies the UDP or TCP port, or a string that identify the
service (Telnet, SSH, SNMP,...) or the keyword
any
.
The argument
in-interface
can be omitted; in this case it refers to any network interface: the
destination-nat
operation applies regardless of the interface on which the package is received.
The argument
dest-ip
indicates the address that must be used for the Destination NAT operation,
namely the address that will replace the recipient one of the IP packet, before being processed.
