Amer Networks E5Web GUI - Manual (Page 508)

Reversing the order of the NAT and Allow rules as shown below solves the problem.
# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action
1 SAT any all-nets core wan_ip http Destination IP: wwwsrv_ip
2 NAT lan lan_net core wan_ip all_services
3 Allow any all-nets core wan_ip http
The order of events now becomes:
• The client sends traffic to wan_ip in order to reach the webserver:
10.0.0.3:1038 => 195.55.66.77:80
• cOS Core address translates this statically in accordance with rule 1 and dynamically in
accordance with rule 2:
10.0.0.1:32789 => 10.0.0.2:80
• The server at wwwsrv_ip processes the traffic and replies:
10.0.0.2:80 => 10.0.0.1:32789
• The reply arrives and both address translations are restored:
195.55.66.77:80 => 10.0.0.3:1038
In this way, the reply arrives at the client from the expected address.
Another possible solution to the problem is to allow internal clients to communicate directly to
10.0.0.2 without address translation. However, this is not always practical.
7.4.3. Many-to-Many IP Translation
A single SAT rule can be used to transpose an entire range or network of IP addresses to another
range or network. The result is a many-to-many translation where the first original IP address is
translated to the first IP address in the new range or network, then the second to the second, and
so on.
To tell cOS Core to perform this type of translation, the original IP address must be a range or
network and the IP rule's All to One property must be disabled. The new range or network is
specified using a single IP address which is the starting address for the transposition. For
example, 192.168.1.0 would be specified as the new address if the transposition is to the network
192.168.1.0/24 and starting from the first address in the network.
As another example, a SAT IP rule might specify that connections to the 194.1.2.16/29 network
should be translated to 192.168.0.50. The IP rules for this would be:
# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action
1 SAT any all-nets core 194.1.2.16/29 all_services Destination IP: 192.168.0.50
2 Allow any all-nets core 194.1.2.16/29 all_services
These IP rules would result in the following translations:
Original Destination Address Translated Destination Address
194.1.2.16 192.168.0.50
194.1.2.17 192.168.0.51
194.1.2.18 192.168.0.52
Chapter 7: Address Translation
508