Siemens SIMATIC NET SCALANCE S615 Configuration Manual page 47

The reply frames from the external network can pass through the NAT router and firewall
without it being necessary for their addresses to be included extra in the firewall rule and the
NAT address translation. Frames that are not a reply to a query from the internal network are
discarded without a matching firewall rule.
NAT translation and firewall rules
Example of NAT translations
Type Source In‐
terface
①
Source vlan1
(internal)
The rule applies to packets sent from vlan1 (internal) to vlan2 (external). With the packets that arrive at vlan1 there is a
check to establish whether the rule applies.
If the source IP address in the subnet of the sender (Source IP subnet) and the destination IP address in the subnet of the
recipient (Source IP subnet), the source IP address is replaced by the suitable IP address from the "Translated source IP
subnet". The subnet part of the source IP address is changed and the host part remains unchanged.
A packet, for example with the source IP address 192.168.1.102 is changed to 10.100.1.102. For the devices connected
to vlan2 it appears as if the packets were sent from the IP subnet 10.100.1.0/24. This allows for example overlaps of IP
subnets to be resolved. The rule is only specified for the send direction. The retranslation is performed implicitly. If the rule
does not apply, the packets are forwarded without translation.
②
Destina‐ vlan2
tion
(external)
The rule applies to packets sent from vlan2 (external) to vlan1 (internal). With the packets that arrive at vlan2 there is a
check to establish whether the rule applies.
If the source IP address in the subnet of the sender (Source IP subnet) and the destination IP address in the subnet of the
recipient (Source IP subnet), the source IP address is replaced by the suitable IP address from the "Translated destination
IP subnet".
A packet, for example with the source IP address 10.10.10.102 is changed to 192.168.1.102. The devices connected to
vlan1 can communicate with the devices connected to vlan2. This assumes that the corresponding firewall rule is set.
The devices connected to vlan2 must address the devices connected to vlan1 with the virtual IP address from the subnet
10.100.1.0.
Firewall rules for the NAT rules
Example 1:
SCALANCE S615 Web Based Management
Configuration Manual, 11/2019, C79000-G8976-C388-08
Destination In‐ Source IP
terface Subnet
vlan2 192.168.1.
0/24
(external)
vlan1 10.10.10.0/
24
(internal)
NAT rule
Source IP translated Destination IP
subnet Subnet
10.100.1.0/24 10.10.10.0/24
- 10.100.1.0/24
① ②
and
Technical basics
3.5 Security functions
Translated destination IP
-
192.168.1.0/24
47