35. Firewall
ROX™ v2.2 User Guide
371
RuggedBackbone™ RX5000
IP Network/Mask
Address Range
192.168.0.0/16
192.168.0.0 - 192.168.255.255
Table 35.1. RFC1918 Reserved IP Address Blocks
As a packet from a host on the internal network reaches the NAT gateway, its source address and
source TCP/UDP port number are recorded. The address and port number is translated to the public
IP address and an unused port number on the public interface. When the Internet host replies to the
internal host’s packet, it is addressed to the NAT gateway’s external IP at the translation port number.
The NAT gateway searches its tables and makes the opposite changes it made to the outgoing packet.
NAT then forwards the reply packet to the internal host.
Translation of ICMP packets happens in a similar fashion, but without the source port modification.
NAT can be used in static and dynamic modes. Static NAT masks the private IP addresses by translating
each internal address to a unique external address. Dynamic NAT translates all internal addresses to
one or more external addresses.
35.1.4. Port Forwarding
Port forwarding, also known as redirection, allows traffic coming from the Internet to be sent to a host
behind the NAT gateway.
Previous examples have described the NAT process when connections are made from the intranet to
the Internet. In those examples, addresses and ports were unambiguous.
When connections are attempted from the Internet to the intranet, the NAT gateway will have multiple
hosts on the intranet that could accept the connection. It needs additional information to identify the
specific host to accept the connection.
Suppose that two hosts, 192.168.1.10 and 192.168.1.20 are located behind a NAT gateway having a
public interface of 213.18.101.62. When a connection request for http port 80 arrives at 213.18.101.62,
the NAT gateway could forward the request to either of the hosts (or could accept it itself). Port
forwarding configuration could be used to redirect the requests to port 80 to the first host.
Port forwarding can also remap port numbers. The second host may also need to answer http requests.
As connections to port 80 are directed to the first host, another port number (such as 8080) can be
dedicated to the second host. As requests arrive at the gateway for port 8080, the gateway remaps the
port number to 80 and forwards the request to the second host.
Finally, port forwarding can take the source address into account. Another way to solve the above
problem could be to dedicate two hosts 200.0.0.1 and 200.0.0.2 and have the NAT gateway forward
requests on port 80 from 200.0.0.1 to 192.168.1.10 and from 200.0.0.2 to 192.168.1.20.
35.2. Firewall Quick Setup
For users familiar with the firewall the following will serves as a reminder of how to build the firewall.
New users may wish to read
Section 35.3, “Firewall Terminology And Concepts”
before continuing.
1.
Logically partition your network into zones. Will you establish a DMZ? Will all Ethernet interfaces
need to forward traffic to the public network? Which interfaces are to be treated in a similar fashion?
2.
Assign your interfaces to the zones. If using T1/E1, have you created your T1/E1 interfaces prior
to building the firewall?
3.
Set the default policies for traffic from zone to zone to be as restrictive as possible. Has the local
zone been blocked from connecting to the DMZ or firewall? Does the DMZ or firewall need to accept
connections? Which connections should be dropped and which reset? What logs are kept?
4.
How is the network interface IP assigned, i.e. dynamically or statically? Do hosts at the central site
need to know the local address?
