D-Link DFL-800-AV-12 User Manual - Page 218
SAT and FwdFast Rules, External traffic to wan_ip:80 will match rules 1 and 5
View all D-Link DFL-800-AV-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 218 highlights
7.3.7. SAT and FwdFast Rules Chapter 7. Address Translation # Action 5 NAT Src Iface lan Src Net lannet What happens now? Dest Iface any Dest Net all-nets Parameters All • External traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Correct. • Return traffic from wwwsrv:80 will match rules 2 and 4, and will appear to be sent from wan_ip:80. Correct. • Internal traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Almost correct; the packets will arrive at wwwsrv, but: • Return traffic from wwwsrv:80 to internal machines will be sent directly to the machines themselves. This will not work, as the packets will be interpreted as coming from the wrong address. We will now try moving the NAT rule between the SAT and FwdFast rules: # Action 1 SAT 2 SAT 3 NAT 4 FwdFast 5 FwdFast Src Iface any lan lan any lan Src Net all-nets wwwsrv lannet all-nets wwwsrv Dest Iface core any any core any Dest Net wan_ip all-nets all-nets wan_ip all-nets Parameters http SETDEST wwwsrv 80 80 -> All SETSRC wan_ip 80 All http 80 -> All What happens now? • External traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. Correct. • Return traffic from wwwsrv:80 will match rules 2 and 3. The replies will therefore be dynamically address translated. This changes the source port to a completely different port, which will not work. The problem can be solved using the following rule set: # Action 1 SAT 2 SAT 3 FwdFast 4 NAT 5 FwdFast Src Iface any lan lan lan lan Src Net all-nets wwwsrv wwwsrv lannet wwwsrv Dest Iface core any any any any Dest Net wan_ip all-nets all-nets all-nets all-nets Parameters http SETDEST wwwsrv 80 80 -> All SETSRC wan_ip 80 80 -> All All 80 -> All • External traffic to wan_ip:80 will match rules 1 and 5, and will be sent to wwwsrv. • Return traffic from wwwsrv:80 will match rules 2 and 3. • Internal traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. The sender address will be the D-Link Firewall's internal IP address, guaranteeing that return traffic passes through the D-Link Firewall. • Return traffic will automatically be handled by the D-Link Firewall's stateful inspection mechanism. 218