Port Translation; Which Protocols Can Sat Handle - D-Link NetDefend DFL-210 User Manual

7.2.4. Port Translation

and 194.1.2.30) to the IP 192.168.0.50.
• Attempts to communicate with 194.1.2.16, port 80, will result in a connection to 192.168.0.50
• Attempts to communicate with 194.1.2.30, port 80, will result in a connection to 192.168.0.50
7.2.4. Port Translation
Port Translation, also known as PAT (Port Address Translation), can be used to modify the source
or destination port.
# Action Src Iface
1 SAT any
This rule produces a 1:1 translation of all ports in the range 80 - 85 to the range 1080 - 1085.
• Attempts to communicate with the web servers public address, port 80, will result in a connec-
tion to the web servers private address, port 1080.
• Attempts to communicate with the web servers public address, port 84, will result in a connec-
tion to the web servers private address, port 1084.

7.2.5. Which Protocols can SAT handle?

Generally, static address translation can handle all protocols that allow address translation to take
place. However, there are protocols that can only be translated in special cases, and other protocols
that simply cannot be translated at all.
Protocols that are impossible to translate using SAT are most likely also impossible to translate us-
ing NAT. Reasons for this include:
• The protocol cryptographically requires that the addresses are unaltered; this applies to many
VPN protocols.
• The protocol embeds its IP addresses inside the TCP or UDP level data, and subsequently re-
quires that, in some way or another, the addresses visible on IP level are the same as those em-
bedded in the data. Examples of this include FTP and logons to NT domains via NetBIOS.
• Either party is attempting to open new dynamic connections to the addresses visible to that
party. In some cases, this can be resolved by modifying the application or the firewall configura-
tion.
There is no definitive list of what protocols that can or cannot be address translated. A general rule
is that VPN protocols cannot usually be translated. In addition, protocols that open secondary con-
nections in addition to the initial connection can be difficult to translate.
Some protocols that are difficult to address translate may be handled by specially written algorithms
Note
When 0.0.0.0/0 is the destination, All-to-One mapping is always done.
Src Net Dest Iface
all-nets core
Note
In order to create a SAT Rule that allows port transation, a Custom Service must be
used with the SAT Rule.
Dest Net Parameters
wwwsrv_pub TCP 80-85 SETDEST 192.168.0.50 1080
170
Chapter 7. Address Translation