Enabling Traffic To A Web Server On An Internal Network - D-Link DFL-1660 User Manual

7.4.1. Translation of a Single IP
Address (1:1)
address translation can take place if the connection has been permitted, and rule 2 permits the connection.
The SAT rule destination interface must be core because interface IPs are always routed on core.
A NAT rule may also be needed to allow internal computers access to the public Internet:
# Action
1 SAT
2 Allow
3 NAT
The problem with this rule set is that it makes internal addresses visible to computers on the DMZ. When
computers connect to wan_ip port 80, they will be allowed to proceed by rule 2. From a security perspective,
hosts in the DMZ should be regarded as untrustworthy.
There are two possible solutions:
1. Change rule 2 so that it only applies to external traffic.
2. Swap rules 2 and 3 so that the NAT rule is carried out for internal traffic before the Allow rule triggers.
Which of these two options is best? For this configuration, it makes no difference and both work.
However, suppose that we use another interface, ext2, on the firewall and connect it to another network, perhaps
to that of a neighboring company so that they can communicate much faster with our servers.
If option 1 was selected, the rule set must be adjusted like this:
# Action
1 SAT
2 Allow
3 Allow
4 NAT
This increases the number of rules for each interface allowed to communicate with the web server. However, the
rule ordering is unimportant, which may help avoid errors.
If option 2 was selected, the rule set must be adjusted like this:
# Action
1 SAT
2 NAT
3 Allow
This means that the number of rules does not need to be increased. This is good as long as all interfaces can be
trusted to communicate with the web server. If, however, at a later point we add an interface that cannot be
trusted to communicate with the web server, separate Drop rules would have to be placed before the rule granting
all machines access to the web server.
Determining the best course of action must be done on a case-by-case basis, taking all circumstances into
account.
Example 7.4. Enabling Traffic to a Web Server on an Internal Network
In this example, a web server with a private IPv4 address is located on an internal network. This example has
been chosen for its simplicity but this approach is inadvisable from a security standpoint as web servers are best
located in a DMZ.
In order for external users to access the web server, they must be able to contact it using a public address. In this
example, we have chosen to translate port 80 on the firewall's external address to port 80 on the web server:
Src Iface Src Net Dest Iface
any all-nets
any all-nets
lan lannet
Src Iface Src Net Dest Iface
any all-nets
wan all-nets
ext2 ext2net
lan lannet
Src Iface Src Net Dest Iface
any all-nets
lan lannet
any all-nets
Dest Net
core wan_ip
core wan_ip
any all-nets
Dest Net
core wan_ip
core wan_ip
core wan_ip
any all-nets
Dest Net
core wan_ip
core wan_ip
core wan_ip
381
Chapter 7. Address Translation
Parameters
http SETDEST 10.10.10.5 80
http
All
Parameters
http SETDEST 10.10.10.5 80
http
http
all_services
Parameters
http SETDEST 10.10.10.5 80
all_services
http