Copyright © 2013 Weidmüller Interface GmbH & Co. KG
53 / 103
All rights reserved. Reproduction without permission is prohibited.
A2 - Connecting 2 Ethernet networks with activated NAT masquerading
and using IP address forwarding
This Technical Note applies to the Weidmüller Industrial Router IE-SR-2GT-LAN and IE-SR-2GT-UMTS/3G
Application requirements:
There are 2 industrial Ethernet networks which are connected by the Router. Each network has its own IP address
range. For security reasons the IP addresses of network 1 shall be hidden against devices of network 2. As an exception
2 devices (C and D) of network 1 should be accessible directly from devices of network 2.
No special firewall filter rules shall be configured.
Solution:
1. Activating “NAT masquerading” at
WAN
port of the Router which is connected to network 2. As result the sender IP
addresses of any outgoing traffic at WAN port
– initiated by devices of network 1 connect to LAN port – will be trans-
lated to the IP address of the Router
’s WAN port. From the perspective of the receivers the sender is always the Router
WAN port. The IP addresses of devices connected to the LAN port will be hidden and are not visible.
2. To get access to the devices C and D of the hidden network 1 the Router’s “IP address forwarding” feature can be
used, which assigns devices C and D an additional and unused IP address from the range of network 2. Effectively the
Router will have 3 IP addresses at WAN port (Physical WAN IP address and 2 virtual IP addresses). This feature acts
as a special kind of “port forwarding” using only IP addresses and omitting the ports.
Note:
Generally “masquerading” only hides a sender IP address (e.g. outgoing from LAN to WAN) but does NOT
block the access to this LAN IP address from WAN network. This explicitly has to be done by a firewall rule.
In this example the IP address ranges are set to
192.168.
10
.0 / 255.255.255.0 for network 1 and
192.168.
20
.0 / 255.255.255.0 for network 2
The Router interfaces will be set to
192.168.
10
.254 / 255.255.255.0
for LAN interface and
192.168.
20
.254 / 255.255.255.0
for WAN interface
Network diagram of below described application scenario
Network 1: 192.168.10.0 / 24
(Class C)
LAN port
192.168.
10.254
255.255.255.0
Device A
192.168
.10.100
255.255.255.0
GW 192.168.
10
.254
Device B
192.168
.10.101
255.255.255.0
GW 192.168.
10
.254
Device C
192.168
.10.102
255.255.255.0
GW 192.168.
10
.254
Network 2: 192.168.20.0 / 24
(Class C)
Device E
192.168
.20.100
255.255.255.0
No Standard gateway
Device F
192.168
.20.101
255.255.255.0
No Standard gateway
Device G
192.168
.20.102
255.255.255.0
No Standard gateway
WAN port
192.168.
20.254
255.255.255.0
S
w
it
c
h
S
w
it
c
h
All IP addresses of network 1 will be
hidden by the router. Any IP address of
outgoing traffic from network 1 will be
translated to the IP address of WAN
port of the router (192.168.20.254).
Tasks:
1
. Hiding the IP addresses of network 1
by activating NAT masquerading at router’s WAN port
2
. As an exception devices C and D should be accessed directly by assigning a virtual IP address from the IP range of
network 2
Solution:
1. Activating NAT masquerading on
WAN port
2. Assigning not used IP addresses
of network 2 as virtual IP addresses
to devices of network 1 which shall
be accessed directly
Device D
192.168
.10.103
255.255.255.0
GW 192.168.
10
.254
Device C can directly accessed by
assigning a virtual IP address
192.168.20.202
(from range of network 2)
M
a
s
q
u
e
ra
d
e
d
(
h
id
d
e
n
)
n
e
tw
o
rk
Device D can directly accessed by
assigning a virtual IP address
192.168.20.203
(from range of network 2)
192.168.
20.202
192.168.
20.203
