Sat And Fwdfast Rules - D-Link DFL-1660 User Manual

7.3.7. SAT and FwdFast Rules

if anyone tries to connect to the public address of the web server, the destination address will be
changed to its private address.
# Action Src Iface
1 SAT lan
2 SAT any
In this instance, both rules are set to translate the destination address, meaning that only one of them
will be carried out. If an attempt is made internally to communicate with the web servers public
address, it will instead be redirected to an intranet server. If any other attempt is made to
communicate with the web servers public address, it will be redirected to the private address of the
publicly accessible web server.
Again, note that the above rules require a matching Allow rule at a later point in the rule set in order
to work.
7.3.7. SAT and FwdFast Rules
It is possible to employ static address translation in conjunction with FwdFast rules, although return
traffic must be explicitly granted and translated.
The following rules make up a working example of static address translation using FwdFast rules to
a web server located on an internal network:
# Action
1 SAT
2 SAT
3 FwdFast
4 FwdFast
We now add a NAT rule to allow connections from the internal network to the Internet:
# Action
5 NAT
What happens now is as follows:
• External traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. Correct.
• Return traffic from wwwsrv:80 will match rules 2 and 4, and will appear to be sent from
wan_ip:80. Correct.
• Internal traffic to wan_ip:80 will match rules 1 and 3, and will be sent to wwwsrv. This is amost
correct; the packets will arrive at wwwsrv, but:
• Return traffic from wwwsrv:80 to internal machines will be sent directly to the machines
themselves. This will not work, as the packets will be interpreted as coming from the wrong
address.
We will now try moving the NAT rule between the SAT and FwdFast rules:
# Action
1 SAT
2 SAT
3 NAT
4 FwdFast
5 FwdFast
What happens now?
• External traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. Correct.
Src Net Dest Iface
lannet wwwsrv_pub
all-nets wwwsrv_pub
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
any all-nets core
lan wwwsrv any
Src Iface Src Net Dest Iface
lan lannet any
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan lannet any
any all-nets core
lan wwwsrv any
Dest Net Parameters
TCP 80-85 SETDEST intrasrv 1080
TCP 80-85 SETDEST wwwsrv-priv 1080
Dest Net
wan_ip
all-nets
wan_ip
all-nets
Dest Net
all-nets
Dest Net
wan_ip
all-nets
all-nets
wan_ip
all-nets
308
Chapter 7. Address Translation
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
http
80 -> All
Parameters
All
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
All
http
80 -> All