Sat with fwdfast rules – Amer Networks E5Web GUI User Manual
Page 515

•
Attempts to communicate with the web server's public address - port 84, will result in a
connection to the web server's private address - port 1084.
If the Service was changed so that only the single value 80 was specified for is Port property then
the SAT rule would only trigger for port 80 and it would always be translated to the new port
1080 (a one-to-one relationship)
7.4.6. SAT with FwdFast Rules
It is possible to SAT IP rules in conjunction with FwdFast IP rules. In other words, to use SAT with
stateless connections. The difference in this case is that the return traffic must be explicitly
translated and allowed by separateFwdFast IP rules.
The following table shows the correct configuration of SAT rules with FwdFast rules for
connections to a web server with the private IP address wwwsrv located on an internal network:
# Action
Src Iface
Src Net
Dest Iface Dest Net
Service
SAT Action
1 SAT
any
all-nets
core
wan_ip
http
Destination IP: wwwsrv
2 SAT
lan
wwwsrv
any
all-nets
http
Source IP: wan_ip
3 FwdFast any
all-nets
core
wan_ip
http
4 FwdFast lan
wwwsrv
any
all-nets
http
Suppose now, that access to the public Internet by clients on the internal network lan_net is
required. The following NAT rule might be added after the other rules by the administrator:
# Action
Src Iface
Src Net
Dest Iface Dest Net
Service
SAT Action
5 NAT
lan
lan_net
any
all-nets
all_services
However, this is not correct. What will happen with this additional rule is the following:
•
External traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is correct.
•
Return traffic from wwwsrv will match rules 2 and 4, and will appear to be sent from
wan_ip:80. This is correct.
•
Internal traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is almost
correct; the packets will arrive at wwwsrv, but:
•
Return traffic from wwwsrv to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.
The administrator might try moving the NAT IP rule to between the SAT and FwdFast rules as
shown below:
# Action
Src Iface
Src Net
Dest Iface Dest Net
Service
SAT Action
1 SAT
any
all-nets
core
wan_ip
http
Destination IP: wwwsrv
2 SAT
lan
wwwsrv
any
all-nets
http
Source IP: wan_ip
3 NAT
lan
lan_net
any
all-nets
all_services
4 FwdFast any
all-nets
core
wan_ip
http
5 FwdFast lan
wwwsrv
any
all-nets
http
This will still not be correct since the following will happen:
Chapter 7: Address Translation
515