CyberGuard SnapGear, Руководство пользователя

Страница: 74 / 185

Firewall
70
Packet Filtering
By default, your SnapGear appliance allows network traffic as shown in the following
table:
You can configure your SnapGear appliance with additional filter rules to allow or restrict
network traffic. These rules can match traffic based on the source and destination
address, the incoming and outgoing network port, and/or the services.
You can also configure your SnapGear appliance to perform network address translation
(NAT). This may be in the form of source address NAT, destination address NAT, or 1-
to-1 NAT. Network address translation modifies the IP address and/or port of traffic
traversing the SnapGear appliance.
The most common use of this is for port forwarding (aka PAT/Port Address Translation)
from ports on the SnapGear WAN interface to ports on machines on the LAN side. This
is the most common way for internal, masqueraded servers to offer services to the
outside world. Destination NAT rules are used for port forwarding.
Source NAT rules are useful for masquerading one or more IP addresses behind a single
other IP address. This is the type of NAT used by the SnapGear appliance to
masquerade your private network behind its public IP address.
1-to-1 NAT creates both Destination NAT and Source NAT rules for full IP address
translation in both directions. This can be useful if you have a range of IP addresses that
have been added as interface aliases on the SnapGear appliance’s WAN interface, and
want to associate one of these external alias IP addresses with a single internal,
masqueraded computer. This effectively allocates the internal computer its own real
world IP address, also known as a
virtual DMZ .
Function NAT Method
Port forwarding (PAT) Destination NAT
Masquerading Source NAT
Virtual DMZ 1-to-1 NAT
Incoming Interface Outgoing Interface Action
LAN/VPN/Dial-In Any Accept
DMZ WAN Accept
DMZ Any except WAN Drop
WAN Any Drop