35. Firewall
ROX™ v2.2 User Guide
374
RuggedBackbone™ RX5000
35.3.5. Masquerading and SNAT
Masquerading and Source NAT (SNAT) are forms of dynamic NAT.
Masquerading substitutes a single IP address for an entire internal network. Use masquerading when
your ISP assigns you an IP address dynamically at connection time.
SNAT substitutes a single address or range of addresses that have been assigned by your ISP. Use
SNAT when your ISP assigns you one or more static IP addresses that you wish to use for one or more
internal hosts.
Interface Subnet Address Protocol Port(s)
Interface is the outgoing (WAN or Ethernet) interface and is usually your Internet interface.
Subnet is the subnet that you wish to hide. It can be an interface name (such as switch.0001) or a
subnetted IP address.
Address is an (optional IP) address that you wish to masquerade as.
The presence of the Address field determines whether masquerading or SNAT is being
used. Masquerading is used when only Interface and Subnet are present. SNAT is used
when Interface, Subnet and Address are present.
Protocol (optionally) takes on the name of protocols (e.g. tcp, udp) that you wish to masquerade.
Ports (optionally) takes on the ports to masquerade when protocol is set to tcp or udp. These can be
raw port numbers or names as found in file /etc/services.
Some examples should illustrate the use of masquerading:
Rule
Interface
Subnet
Address
Protocol
Ports
1
switch.0001
switch.0002
2
ppp+
switch.0002
66.11.180.161
3
ppp+
192.168.0.0/24
66.11.180.161
4
w1ppp
switch.0001
100.1.101.16
5
w1ppp
switch.0001
100.1.101.16
tcp
smtp
Table 35.6. Masquerading Examples
1.
In this masquerading rule, port switch.0002 is connected to the local network and switch.0001 is
connected to a DSL modem. Traffic from the subnet handled by switch.0002 should be translated
to whatever IP is assigned to the modem. Internet clients will not be able to determine the router’s
public address unless some form of dynamic DNS is employed.
2.
In this SNAT rule, a static address of 66.11.180.161 is acquired from the ISP. Traffic from the subnet
handled by switch.0002 should be translated to 66.11.180.161 as it sent to the Internet over ppp.
The + at the end of “ppp+” causes the ROX™ firewall to match any ppp interface.
3.
This example is much the same as the previous one only the subnet is explicitly described, and
could include traffic from any of the Ethernet ports.
4.
In this SNAT rule, traffic from the subnet handled by only port switch.0001 should be translated to
100.1.101.16 as it sent to the Internet on t1/e1 port w1ppp.
5.
This example is much the same as the previous one excepting that only smtp from switch.0001
will be allowed.
