Sat; Introduction - D-Link NetDefendOS User Manual

7.4. SAT

7.4.1. Introduction

NetDefendOS Static Address Translation (SAT) functionality can translate ranges of IP addresses
and/or port numbers to other, predefined static values. The translation can be to a single address
and/or port but can also be a transposition where each address and/or port in a range or
network is mapped to a corresponding value in a new range or network.
Types of Translation
SAT translation can be generally divided into three types:
• One-to-one translation - A single value is translated to another single value.
• Many-to-one translation - Multiple values are translated to one single value.
• Many-to-many translation - Multiple values are transposed to different multiple values.
The values being translated may be the IP address and/or the port number for either the source
or destination of new connections set up by NetDefendOS. As discussed later, the many-to-one
translation is not available for port numbers.
SAT Requires Multiple IP Rules
Unlike NAT, SAT requires more than a single IP rule when it is configured. A SAT rule that triggers
for the target traffic must first be created to specify the translation required. However,
NetDefendOS does not terminate rule set lookups after finding a matching SAT rule. Instead, the
rule set search continues for a matching Allow, NAT or FwdFast rule. Only when NetDefendOS
finds such a second matching rule is the SAT rule applied to the traffic.
The SAT rule only defines the translation that is to take place. The second, associated IP rule, will
actually allow the traffic to flow.
The Second Rule Triggers on the Untranslated IP Address
An important principle to keep in mind when creating IP rules for SAT is that the second rule, for
example an Allow rule, must trigger on the old, untranslated IP address (either source or
destination IP depending on the type of SAT rule). A common mistake is to create a second IP
rule expecting that it should trigger on the new, translated IP address.
For example, if a SAT rule translates the destination IPv4 address from 192.168.0.1 to 172.16.0.1
then the second associated rule should allow traffic to pass to the destination 192.168.0.1 and
not 172.16.0.1.
Only after the second rule triggers to allow the traffic, is the route lookup then done by
NetDefendOS on the translated destination address to work out which interface the traffic
Note: SAT is the same as port forwarding
Some network equipment vendors use the term "port forwarding" when referring to
SAT. Both terms refer to the same functionality.
588
Chapter 7: Address Translation