HP 7102dl - ProCurve Secure Router Configuration Manual page 308

Configuring Network Address Translation
Configuring NAT
6-10
You can then use the following command to select the traffic that you want
to NAT:
Syntax: [permit | deny] [any | host <A.B.C.D> | hostname <hostname> | <A.B.C.D>
<wildcard bits>]
Table 6-2 lists the options for specifying a source address.
Table 6-2. Options for Specifying Source Address
Option
any
host <A.B.C.D>
host <hostname>
<A.B.C.D>
<A.B.C.D> <wildcard bits>
For example, if you want to NAT all traffic that enters through the Ethernet
interface, you create this permit entry in the ACL:
ProCurve(config-std-nacl)# permit any
If you want to NAT a subnet, enter:
ProCurve(config-std-nacl)# permit <A.B.C.D> <wildcard bits>
Replace <A.B.C.D> with the IP address of the subnet and use wildcard bits
to define the number of hosts in the subnet. Wildcard bits define which address
bits the Secure Router OS firewall should match and which address bits it
should ignore. Although wildcard bits resemble subnet masks, they use
reverse logic.
With wildcard bits, 0 means that you want the Secure Router OS firewall to
match that bit; 1 means that you do not want the Secure Router OS firewall to
match that bit.
For example, you might enter:
ProCurve(config-std-nacl)# deny 192.168.115.0 0.0.0.31
Meaning
match all hosts
specify a single host
specify a single host
specify a single IP address
specify a range of IP addresses