D-Link DFL-260E User Manual for DFL-260E - Page 375

7.4.1. Translation of a Single IP Address (1:1) Chapter 7. Address Translation address translation can take place if the connection has been permitted, and rule 2 permits the connection. The SAT rule destination interface must be core because interface IPs are always routed on core. A NAT rule may also be needed to allow internal computers access to the public Internet: # Action 1 SAT 2 Allow 3 NAT Src Iface any any lan Src Net all-nets all-nets lannet Dest Iface core core any Dest Net wan_ip wan_ip all-nets Parameters http SETDEST 10.10.10.5 80 http All The problem with this rule set is that it makes internal addresses visible to computers on the DMZ. When computers connect to wan_ip port 80, they will be allowed to proceed by rule 2. From a security perspective, hosts in the DMZ should be regarded as untrustworthy. There are two possible solutions: 1. Change rule 2 so that it only applies to external traffic. 2. Swap rules 2 and 3 so that the NAT rule is carried out for internal traffic before the Allow rule triggers. Which of these two options is best? For this configuration, it makes no difference and both work. However, suppose that we use another interface, ext2, on the firewall and connect it to another network, perhaps to that of a neighboring company so that they can communicate much faster with our servers. If option 1 was selected, the rule set must be adjusted like this: # Action 1 SAT 2 Allow 3 Allow 4 NAT Src Iface any wan ext2 lan Src Net all-nets all-nets ext2net lannet Dest Iface core core core any Dest Net wan_ip wan_ip wan_ip all-nets Parameters http SETDEST 10.10.10.5 80 http http all_services This increases the number of rules for each interface allowed to communicate with the web server. However, the rule ordering is unimportant, which may help avoid errors. If option 2 was selected, the rule set must be adjusted like this: # Action 1 SAT 2 NAT 3 Allow Src Iface any lan any Src Net all-nets lannet all-nets Dest Iface core core core Dest Net wan_ip wan_ip wan_ip Parameters http SETDEST 10.10.10.5 80 all_services http This means that the number of rules does not need to be increased. This is good as long as all interfaces can be trusted to communicate with the web server. If, however, at a later point we add an interface that cannot be trusted to communicate with the web server, separate Drop rules would have to be placed before the rule granting all machines access to the web server. Determining the best course of action must be done on a case-by-case basis, taking all circumstances into account. Example 7.4. Enabling Traffic to a Web Server on an Internal Network In this example, a web server with a private IPv4 address is located on an internal network. This example has been chosen for its simplicity but this approach is inadvisable from a security standpoint as web servers are best located in a DMZ. In order for external users to access the web server, they must be able to contact it using a public address. In this example, we have chosen to translate port 80 on the firewall's external address to port 80 on the web server: 375