Amer-networks E5Web GUI Manual de usuario descargar pdf (Pagina 508)

100

101

Reversing the order of the NAT and Allow rules as shown below solves the problem.

# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action

1 SAT any all-nets core wan_ip http Destination IP: wwwsrv_ip

2 NAT lan lan_net core wan_ip all_services

3 Allow any all-nets core wan_ip http

The order of events now becomes:

• The client sends traffic to wan_ip in order to reach the webserver:

10.0.0.3:1038 => 195.55.66.77:80

• cOS Core address translates this statically in accordance with rule 1 and dynamically in

accordance with rule 2:

10.0.0.1:32789 => 10.0.0.2:80

• The server at wwwsrv_ip processes the traffic and replies:

10.0.0.2:80 => 10.0.0.1:32789

• The reply arrives and both address translations are restored:

195.55.66.77:80 => 10.0.0.3:1038

In this way, the reply arrives at the client from the expected address.

Another possible solution to the problem is to allow internal clients to communicate directly to

10.0.0.2 without address translation. However, this is not always practical.

7.4.3. Many-to-Many IP Translation

A single SAT rule can be used to transpose an entire range or network of IP addresses to another

range or network. The result is a many-to-many translation where the first original IP address is

translated to the first IP address in the new range or network, then the second to the second, and

so on.

To tell cOS Core to perform this type of translation, the original IP address must be a range or

network and the IP rule's All to One property must be disabled. The new range or network is

specified using a single IP address which is the starting address for the transposition. For

example, 192.168.1.0 would be specified as the new address if the transposition is to the network

192.168.1.0/24 and starting from the first address in the network.

As another example, a SAT IP rule might specify that connections to the 194.1.2.16/29 network

should be translated to 192.168.0.50. The IP rules for this would be:

# Action Src Iface Src Net Dest Iface Dest Net Service SAT Action

1 SAT any all-nets core 194.1.2.16/29 all_services Destination IP: 192.168.0.50

2 Allow any all-nets core 194.1.2.16/29 all_services

These IP rules would result in the following translations:

Original Destination Address Translated Destination Address

194.1.2.16 192.168.0.50

194.1.2.17 192.168.0.51

194.1.2.18 192.168.0.52

Chapter 7: Address Translation

508

1 2 ... 503 504 505 506 507 508 509 510 511 512 513 ... 776 777

Comentarios a estos manuales

Sin comentarios

Amer-networks E5Web GUI Manual de usuario Pagina 508

Comentarios a estos manuales

Relacionado con productos y manuales para Accesorios De Computador Amer-networks E5Web GUI