4RF Aprisa SR+, Руководство пользователя

Страница: 51 / 492

About the Radio | 51
Aprisa SR+ User Manual 1.11.1
Port Forwarding NAT (NAPT) Operation
The following figure describes an example of Port Forwarding used for security, hiding the private IP address
from the public interface network and it can be used to preserve private IP address even if public IP network
subnet might change, reducing operational risk and expense. In this example, Port Forwarding NAT is
configured at the Base Station in AGRM mode including the user configuration of NAT Address Map Table and
expected session table (a detailed in / outbound session is shown for clarity of explanation, where NAT
session table in SuperVisor will show a session in one line which will include inbound / outbound transactions,
session duration, statistics, etc).
NAT Address Map Table - [Base Station, Public Interface: Eth-1]
Order
ID
Match To… Translate To… Active
Public Dest IP
Address Start Public Dest
Port Start Public Dest
Port End Protocol Private Dest IP
Address Start
Private Dest
Port
1 192.168.2.2 8081 8087 Any 10.10.1.1 80
✓
2 192.168.2.2 10003 10006 Any 10.10.1.3 502
✓
3 192.168.2.2 101 107 ICMP 10.10.1.1 200
✓
NAT Session Table - [Base Station, Eth-1]
ID In Out
bound
Public IP
Src Addr Public IP
Dest Addr Public
Src Port Public
Dst Port Protocol Private IP
Src Addr Private IP
Dest Addr Private
Src Port Private
Dst Port Comments
1 In 172.16.1.1 192.168.2.2 PPP 80 Any N/A N/A N/A N/A Management > Base
2 In 172.16.1.1 192.168.2.2 XYZ 8081 Any 172.16.1.1 10.10.1.1 XYZ 80 Management >
Remote-1
3 Out 192.168.2.2 172.16.1.1 8081 XYZ Any 10.10.1.1 172.16.1.1 80 XYZ Remote-1 >
Management
4 In 172.16.1.1 192.168.2.2 XXX 10003 Any 172.16.1.1 10.10.1.3 XXX 502 SCADA > RTU-1
(Modbus)
5 Out 192.168.2.2 172.16.1.1 10003 XXX Any 10.10.1.3 172.16.1.1 502 XXX
RTU-1 (Modbus) >
SCADA
6 In 172.16.1.1 192.168.2.2 FFF 20000 Any N/A N/A N/A N/A To Base CPU (and drop)
7 Out 192.168.2.2 172.16.1.1 10003 RRR Any 10.10.1.3 172.16.1.1 502 RRR RBE RTU-1 > SCADA
8 Out 192.168.2.2 172.16.1.1 NNN 23 Any 10.10.1.3 172.16.1.1 ZZZ 23 RTU-1 (Telnet) >
SCADA
9 In 172.16.1.1 192.168.2.2 23 NNN Any 172.16.1.1 10.10.1.3 23 ZZZ To Base CPU (and drop)
10 In 172.16.1.1 192.168.2.2 N/A 102 ICMP 172.16.1.1 10.10.1.1 N/A 200 Ping (Req.) > Remote-2
11 Out 192.168.2.2 172.16.1.1 102 N/A ICMP 10.10.1.1 172.16.1.1 200 N/A Remote-2 > Ping
(Resp.)