Session Handling
51
Tip
With pcp allowed on a subnet you can see what mappings are created, and then carefully decide which
mappings you wish to allow in firewall rules.
7.4. Network Address Translation
Network Address Translation (NAT) is the general term used for sharing one IP address between multiple
devices. It is typically a feature of broadband routers that are designed to operate with one external IP address
and private (RFC1918) addresses on the inside (such as 192.168.x.x).
In additional to NAT, there are several ways in which one can do various types of port mapping and IP mapping
which are described in the general session tracking and firewalling rules above. However, NAT is, itself, a
complex issue and this section describes some of the issues and recommendations for how best to use NAT
on a FireBrick.
7.4.1. When to use NAT
NAT breaks the way Internet Protocol was designed as it stops end to end addressing and routing of packets.
This causes problems with all sorts of protocols that sensibly expect IP to work as designed, and even some that
assume NAT is in use. NAT is not itself a consistent and predictable process, and so it makes it very difficult
for protocol designed.
Because of the many issues with NAT it is strongly recommended that NAT is only ever used where it is
unavoidable. This is specifically where the availability of public IP addresses is limited.
Unfortunately with legacy IP version 4 addresses the supply of address space is now limited and most ISPs are
only providing a single IPv4 address with an Internet Connection (or charging where more are provided). This
means that it is common to require NAT for IPv4 on a typical Internet connection.
Tip
It is strongly recommended that you make use of PPPoE to connect to such an Internet connection,
thereby affording the FireBrick itself with the single public IPv4 address assigned to the connection.
This allows a number of features to work without use of NAT, including DNS relay, VoIP, and other
internal operations of the FireBrick (e.g. clock setting, s/w updates, etc).
Note
There is never any excuse to use NAT with IPv6. There is a virtually unlimited supply of IPv6
address space and you should have no problem obtaining necessary IPv6 address space from your ISP
(assuming they do the current Internet Protocol, which is version 6). Remember, NAT is not a means
of protection - the FireBrick has a firewall for that, NAT is a workaround for IP address sharing,
something that is simply not necessary with IPv6 and should not be encouraged.
7.4.2. NAT ALGs
Because of the many problems with NAT and the ways in which many protocols are broken by its use, many
NAT devices (such as broadband routers) will provide an Application Layer Gateway (ALG) as part of the
NAT implementation. This provides special case handling for each higher level protocol or system making use
of NAT that the device knows of, and provides work-arounds for the issues caused by NAT. In some cases this
may simply be customised session timeout, but in some cases the support can be extensive and make major
changes to the payload of packets passed through the device.
ALGs have a number of problems. Obviously they only work at all where the device knows of the protocol in
question, and this is a major draw back for new protocol development. However, they are often imperfect in the
way they work. It is not uncommon for ALGs designed to support VoIP using SIP to be significantly flawed
such that you are better off turning off the ALG and leaving end devices to work around the NAT themselves.
Содержание FB6402
Страница 1: ...FireBrick FB6402 User Manual FB6000 Versatile Network Appliance...
Страница 2: ......
