D-Link NetDefend DFL-210 User Manual page 185

7.2.7. SAT and FwdFast Rules
• Return traffic from wwwsrv:80 will match rules 2 and 4, and will appear to be sent from
wan_ip:80. Correct.
• Internal traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Almost cor-
rect; the packets will arrive at wwwsrv, but:
• Return traffic from wwwsrv:80 to internal machines will be sent directly to the machines them-
selves. This will not work, as the packets will be interpreted as coming from the wrong address.
We will now try moving the NAT rule between the SAT and FwdFast rules:
# Action
1 SAT
2 SAT
3 NAT
4 FwdFast
5 FwdFast
What happens now?
• External traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. Correct.
• Return traffic from wwwsrv:80 will match rules 2 and 3. The replies will therefore be dynamic-
ally address translated. This changes the source port to a completely different port, which will
not work.
The problem can be solved using the following rule-set:
# Action
1 SAT
2 SAT
3 FwdFast
4 NAT
5 FwdFast
• External traffic to wan_ip:80 will match rules 1 and 5, and will be sent to wwwsrv. Correct.
• Return traffic from wwwsrv:80 will match rules 2 and 3. Correct.
• Internal traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. The sender
address will be the D-Link Firewall's internal IP address, guaranteeing that return traffic passes
through the firewall.
• Return traffic will automatically be handled by the D-Link Firewall's stateful inspection mech-
anism.
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan lannet any
any all-nets core
lan wwwsrv any
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan wwwsrv any
lan lannet any
lan wwwsrv any
Dest Net
wan_ip
all-nets
all-nets
wan_ip
all-nets
Dest Net
wan_ip
all-nets
all-nets
all-nets
all-nets
172
Chapter 7. Address Translation
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
All
http
80 -> All
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
80 -> All
All
80 -> All