Sat With Fwdfast Rules - D-Link NetDefendOS User Manual

connection to the web server's private address - port 1084.
If the Service was changed so that only the single value 80 was specified for is Port property then
the SAT rule would only trigger for port 80 and it would always be translated to the new port
1080 (a one-to-one relationship)

7.4.6. SAT with FwdFast Rules

It is possible to SAT IP rules in conjunction with FwdFast IP rules. In other words, to use SAT with
stateless connections. The difference in this case is that the return traffic must be explicitly
translated and allowed by separateFwdFast IP rules.
The following table shows the correct configuration of SAT rules with FwdFast rules for
connections to a web server with the private IP address wwwsrv located on an internal network:
# Action Src Iface Src Net
1 SAT any
2 SAT lan
3 FwdFast any
4 FwdFast lan
Suppose now, that access to the public Internet by clients on the internal network lan_net is
required. The following NAT rule might be added after the other rules by the administrator:
# Action Src Iface Src Net
5 NAT lan
However, this is not correct. What will happen with this additional rule is the following:
• External traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is correct.
• Return traffic from wwwsrv will match rules 2 and 4, and will appear to be sent from
wan_ip:80. This is correct.
• Internal traffic to wan_ip will match rules 1 and 3, and will be sent to wwwsrv. This is almost
correct; the packets will arrive at wwwsrv, but:
• Return traffic from wwwsrv to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.
The administrator might try moving the NAT IP rule to between the SAT and FwdFast rules as
shown below:
# Action Src Iface Src Net
1 SAT any
2 SAT lan
3 NAT lan
4 FwdFast any
5 FwdFast lan
This will still not be correct since the following will happen:
• External traffic to wan_ip will match rules 1 and 4, and will be sent to wwwsrv. This is correct.
Dest Iface Dest Net
all-nets core wan_ip
wwwsrv any all-nets
all-nets core wan_ip
wwwsrv any all-nets
Dest Iface Dest Net
lan_net any all-nets
Dest Iface Dest Net
all-nets core wan_ip
wwwsrv any all-nets
lan_net any all-nets
all-nets core wan_ip
wwwsrv any all-nets
600
Chapter 7: Address Translation
Service SAT Action
http-all Destination IP: wwwsrv
http-all Source IP: wan_ip
http-all
http-all
Service SAT Action
all_services
Service SAT Action
http-all Destination IP: wwwsrv
http-all Source IP: wan_ip
all_services
http-all
http-all