beautypg.com

Sat with fwdfast rules – Amer Networks E5Web GUI User Manual

Page 515

background image

Attempts to communicate with the web server's public address - port 84, will result in a
connection to the web server's private address - port 1084.

If the Service was changed so that only the single value 80 was specified for is Port property then
the SAT rule would only trigger for port 80 and it would always be translated to the new port
1080 (a one-to-one relationship)

7.4.6. SAT with FwdFast Rules

It is possible to SAT IP rules in conjunction with FwdFast IP rules. In other words, to use SAT with
stateless connections. The difference in this case is that the return traffic must be explicitly
translated and allowed by separateFwdFast IP rules.

The following table shows the correct configuration of SAT rules with FwdFast rules for
connections to a web server with the private IP address wwwsrv located on an internal network:

# Action

Src Iface

Src Net

Dest Iface Dest Net

Service

SAT Action

1 SAT

any

all-nets

core

wan_ip

http

Destination IP: wwwsrv

2 SAT

lan

wwwsrv

any

all-nets

http

Source IP: wan_ip

3 FwdFast any

all-nets

core

wan_ip

http

4 FwdFast lan

wwwsrv

any

all-nets

http

Suppose now, that access to the public Internet by clients on the internal network lan_net is
required. The following NAT rule might be added after the other rules by the administrator:

# Action

Src Iface

Src Net

Dest Iface Dest Net

Service

SAT Action

5 NAT

lan

lan_net

any

all-nets

all_services

However, this is not correct. What will happen with this additional rule is the following:

External traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is correct.

Return traffic from wwwsrv will match rules 2 and 4, and will appear to be sent from
wan_ip:80. This is correct.

Internal traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is almost
correct; the packets will arrive at wwwsrv, but:

Return traffic from wwwsrv to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.

The administrator might try moving the NAT IP rule to between the SAT and FwdFast rules as
shown below:

# Action

Src Iface

Src Net

Dest Iface Dest Net

Service

SAT Action

1 SAT

any

all-nets

core

wan_ip

http

Destination IP: wwwsrv

2 SAT

lan

wwwsrv

any

all-nets

http

Source IP: wan_ip

3 NAT

lan

lan_net

any

all-nets

all_services

4 FwdFast any

all-nets

core

wan_ip

http

5 FwdFast lan

wwwsrv

any

all-nets

http

This will still not be correct since the following will happen:

Chapter 7: Address Translation

515

This manual is related to the following products: