RUGGEDCOM ROX II
CLI User Guide
Chapter 6
Security
Network Address Translation
185
RUGGEDCOM ROX II implements an IP firewall using a structured user interface to configure iptables rules and
netfilter rulesets.
Section 6.9.1.3
Network Address Translation
Network Address Translation (NAT) enables a LAN to use one set of IP addresses for internal traffic and a second
set for external traffic. The netfilter NAT function makes all necessary IP address translations as traffic passes
between the Intranet and the Internet. NAT is often referred to in Linux as IP Masquerading.
NAT itself provides a type of firewall by hiding internal IP addresses. More importantly, NAT enables a network
to use more internal IP addresses. Since they are only used internally, there is no possibility of conflict with IP
addresses used by other organizations. Typically, an internal network is configured to use one or more of the
reserved address blocks described in RFC1918.
Table: RFC1918 Reserved IP Address Blocks
IP Network/Mask
Address Range
10.0.0.0/8
10.0.0.0 – 10.255.255.255
172.16.0.0/12
172.16.0.0 – 172.31.255.255
192.168.0.0/16
192.168.0.0 – 192.168.255.255
When a packet from a host on the internal network reaches the NAT gateway, its source address and source TCP/
UDP port number are recorded. The address and port number is translated to the public IP address and an unused
port number on the public interface. When the Internet host replies to the internal host's packet, it is addressed
to the NAT gateway's external IP address at the translation port number. The NAT gateway searches its tables and
makes the opposite changes it made to the outgoing packet. NAT then forwards the reply packet to the internal
host.
Translation of ICMP packets happens in a similar fashion, but without the source port modification.
NAT can be used in static and dynamic modes. Static NAT (SNAT) masks the private IP addresses by translating
each internal address to a unique external address. Dynamic NAT translates all internal addresses to one or more
external addresses.
Section 6.9.1.4
Port Forwarding
Port forwarding, also known as redirection, allows traffic coming from the Internet to be sent to a host behind the
NAT gateway.
Previous examples have described the NAT process when connections are made from the Intranet to the Internet.
In those examples, addresses and ports were unambiguous.
When connections are attempted from the Internet to the Intranet, the NAT gateway will have multiple hosts
on the Intranet that could accept the connection. It needs additional information to identify the specific host to
accept the connection.
Suppose that two hosts, 192.168.1.10 and 192.168.1.20 are located behind a NAT gateway having a public
interface of 213.18.101.62. When a connection request for http port 80 arrives at 213.18.101.62, the NAT
gateway could forward the request to either of the hosts (or could accept it itself). Port forwarding configuration
could be used to redirect the requests to port 80 to the first host.
Содержание RUGGEDCOM ROX II
Страница 2: ...RUGGEDCOM ROX II CLI User Guide ii ...
Страница 4: ...RUGGEDCOM ROX II CLI User Guide iv ...
Страница 39: ...RUGGEDCOM ROX II CLI User Guide Table of Contents xxxix 19 5 VLANs 752 ...
Страница 40: ...Table of Contents RUGGEDCOM ROX II CLI User Guide xl ...
Страница 46: ...Preface RUGGEDCOM ROX II CLI User Guide xlvi Customer Support ...
Страница 96: ...Chapter 2 Using RUGGEDCOM ROX II RUGGEDCOM ROX II CLI User Guide 50 Accessing Maintenance Mode ...
Страница 170: ...Chapter 5 System Administration RUGGEDCOM ROX II CLI User Guide 124 Deleting a Scheduled Job ...
Страница 256: ...Chapter 6 Security RUGGEDCOM ROX II CLI User Guide 210 Enabling Disabling a Firewall ...
Страница 402: ...Chapter 11 Wireless RUGGEDCOM ROX II CLI User Guide 356 Managing Cellular Modem Profiles ...
Страница 646: ...Chapter 13 Unicast and Multicast Routing RUGGEDCOM ROX II CLI User Guide 600 Deleting a Multicast Group Prefix ...
Страница 732: ...Chapter 15 Network Discovery and Management RUGGEDCOM ROX II CLI User Guide 686 Viewing NETCONF Statistics ...
Страница 790: ...Chapter 17 Time Services RUGGEDCOM ROX II CLI User Guide 744 Deleting a Broadcast Multicast Address ...