D-Link NetDefend DFL-210 User Manual page 218

7.3.7. SAT and FwdFast Rules
# Action
5 NAT
What happens now?
• External traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Correct.
• Return traffic from wwwsrv:80 will match rules 2 and 4, and will appear to be sent from
wan_ip:80. Correct.
• Internal traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Almost
correct; the packets will arrive at wwwsrv, but:
• Return traffic from wwwsrv:80 to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.
We will now try moving the NAT rule between the SAT and FwdFast rules:
# Action
1 SAT
2 SAT
3 NAT
4 FwdFast
5 FwdFast
What happens now?
• External traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. Correct.
• Return traffic from wwwsrv:80 will match rules 2 and 3. The replies will therefore be
dynamically address translated. This changes the source port to a completely different port,
which will not work.
The problem can be solved using the following rule set:
# Action
1 SAT
2 SAT
3 FwdFast
4 NAT
5 FwdFast
• External traffic to wan_ip:80 will match rules 1 and 5, and will be sent to wwwsrv.
• Return traffic from wwwsrv:80 will match rules 2 and 3.
• Internal traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. The sender
address will be the D-Link Firewall's internal IP address, guaranteeing that return traffic passes
through the D-Link Firewall.
• Return traffic will automatically be handled by the D-Link Firewall's stateful inspection
mechanism.
Src Iface Src Net Dest Iface
lan lannet any
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan lannet any
any all-nets core
lan wwwsrv any
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan wwwsrv any
lan lannet any
lan wwwsrv any
Dest Net
all-nets
Dest Net
wan_ip
all-nets
all-nets
wan_ip
all-nets
Dest Net
wan_ip
all-nets
all-nets
all-nets
all-nets
218
Chapter 7. Address Translation
Parameters
All
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
All
http
80 -> All
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
80 -> All
All
80 -> All