D-Link DFL-260E User Manual for DFL-260E - Page 372
SAT, 7.4.1. Translation of a Single IP Address (1:1), Note: Port forwarding
View all D-Link DFL-260E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 372 highlights
7.4. SAT Chapter 7. Address Translation 7.4. SAT NetDefendOS can translate entire ranges of IP addresses and/or port numbers. Such translations are transpositions where each address or port is mapped to a corresponding address or port in a new range, rather than translating them all to the same address or port. This functionality is known as Static Address Translation (SAT). Note: Port forwarding Some network equipment vendors use the term "port forwarding" when referring to SAT. Both terms are referring to the same functionality. SAT Requires Multiple IP Rules Unlike NAT, SAT requires more than just a single IP rule to be defined. A SAT rule must first be added to specify the address translation but NetDefendOS does not terminate the rule set lookup after finding a matching SAT rule. Instead, the IP rule search continues for a matching Allow, NAT or FwdFast rule. Only when it has found such a matching rule does NetDefendOS execute the original SAT rule. The SAT rule only defines the translation that is to take place. The second, associated IP rule must exist to actually allow the traffic to traverse the firewall. The Second Rule Must Trigger on the Untranslated Destination IP An important principle to keep in mind when creating the IP rules for SAT is that the second rule, for example an Allow rule, must trigger on the untranslated destination IP address. A common mistake is to create a rule which triggers on the translated address given by the SAT rule. For example, if a SAT rule translates the destination from 1.1.1.1 to 2.2.2.2 then the second associated rule should allow traffic to pass to the destination 1.1.1.1 and not 2.2.2.2. Only after the second rule triggers to allow the traffic, is the route lookup then done by NetDefendOS on the translated address to work out which interface the packets should be sent from. 7.4.1. Translation of a Single IP Address (1:1) The simplest form of SAT usage is translation of a single IP address. A very common scenario for this is to enable external users to access a protected server in a DMZ that has a private address. This is also sometimes referred to as implementing a Virtual IP or as a Virtual Server and is often used in confunction with a DMZ. The Role of a DMZ At this point, it is relevant to discuss the role of the network known as the Demilitarized Zone (DMZ) since SAT rules are often used in allowing DMZ access. The DMZ's purpose is to have a network where the administrator can place those resources which will be accessed by external, untrusted clients and where this access typically takes place across the public Internet. These servers will have the maximum exposure to external threats and are therefore at most risk of being compromised. By isolating these servers in the DMZ, we are creating a distinct separation from the more sensitive local, internal networks. This allows NetDefendOS to better control what traffic flows between the DMZ and internal networks and to better isolate any security breaches that might occur in DMZ servers. 372