forked from extern/shorewall_code
86 lines
5.2 KiB
HTML
86 lines
5.2 KiB
HTML
|
<html>
|
|||
|
|
|
|||
|
|
<head>
|
|||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
|
|||
|
|
<title>Shorewall NAT</title>
|
|||
|
|
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
|||
|
|
<meta name="ProgId" content="FrontPage.Editor.Document">
|
|||
|
|
<meta name="Microsoft Theme" content="radial 011">
|
|||
|
|
</head>
|
|||
|
|
|
|||
|
|
<body background="_themes/radial/radbkgnd.gif" bgcolor="#FFFFFF" text="#000000" link="#6666FF" vlink="#993333" alink="#66CCCC"><!--mstheme--><font face="arial, Arial, Helvetica">
|
|||
|
|
|
|||
|
|
<blockquote>
|
|||
|
|
<h1 align="center"><!--mstheme--><font face="times new roman, Times New Roman, Times" color="#666666">Static NAT<!--mstheme--></font></h1>
|
|||
|
|
<p><font color="#FF0000"><b>IMPORTANT: If all you want to do is forward
|
|||
|
|
ports to servers behind your firewall, you do NOT want to use static NAT.
|
|||
|
|
Port forwarding can be accomplished with simple entries in the
|
|||
|
|
<a href="Documentation.htm#Rules">rules file</a>.</b></font></p>
|
|||
|
|
<p>Static NAT is a way to make systems behind a
|
|||
|
|
firewall and configured with private IP addresses (those
|
|||
|
|
reserved for private use in RFC1918) appear to have public IP
|
|||
|
|
addresses.</p>
|
|||
|
|
<p>The following figure represents a static NAT
|
|||
|
|
environment.</p>
|
|||
|
|
<p align="center"><strong><img src="images/staticnat.jpg" width="595" height="455"></strong></p>
|
|||
|
|
<blockquote>
|
|||
|
|
</blockquote>
|
|||
|
|
<p align="left">Static NAT can be used to make the systems with the
|
|||
|
|
10.1.1.* addresses appear to be on the upper (130.252.100.*) subnet. If we
|
|||
|
|
assume that the interface to the upper subnet is eth0, then the following
|
|||
|
|
/etc/shorewall/NAT file would make the lower left-hand system appear to have
|
|||
|
|
IP address 130.252.100.18 and the right-hand one to have IP address
|
|||
|
|
130.252.100.19.</p>
|
|||
|
|
<!--mstheme--></font><table border="2" cellpadding="2" style="border-collapse: collapse" bordercolordark="#666666" bordercolorlight="#CCCCCC">
|
|||
|
|
<tr>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>EXTERNAL</b><!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>INTERFACE</b><!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>INTERNAL</b><!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>ALL INTERFACES</b><!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica"><b>LOCAL</b><!--mstheme--></font></td>
|
|||
|
|
</tr>
|
|||
|
|
<tr>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">130.252.100.18<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">eth0<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.1.1.2<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">yes<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">yes<!--mstheme--></font></td>
|
|||
|
|
</tr>
|
|||
|
|
<tr>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">130.252.100.19<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">eth0<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">10.1.1.3<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">yes<!--mstheme--></font></td>
|
|||
|
|
<td><!--mstheme--><font face="arial, Arial, Helvetica">yes<!--mstheme--></font></td>
|
|||
|
|
</tr>
|
|||
|
|
</table><!--mstheme--><font face="arial, Arial, Helvetica">
|
|||
|
|
<p>Be sure that the internal system(s) (10.1.1.2 and 10.1.1.3 in the above
|
|||
|
|
example) is (are) not included in any specification in /etc/shorewall/masq
|
|||
|
|
or /etc/shorewall/proxyarp.</p>
|
|||
|
|
<p><a name="AllInterFaces"></a>Note 1: The "ALL INTERFACES" column
|
|||
|
|
is used to specify whether access to the external IP from all firewall
|
|||
|
|
interfaces should undergo NAT (Yes or yes) or if only access from the
|
|||
|
|
interface in the INTERFACE column should undergo NAT. If you leave this
|
|||
|
|
column empty, "Yes" is assumed. The ALL INTERFACES column was
|
|||
|
|
added in version 1.1.6.</p>
|
|||
|
|
<p>Note 2: Shorewall will automatically add the external address to the
|
|||
|
|
specified interface unless you specify <a href="Documentation.htm#Aliases">ADD_IP_ALIASES</a>="no"
|
|||
|
|
(or "No") in /etc/shorewall/shorewall.conf; If you do not set
|
|||
|
|
ADD_IP_ALIASES or if you set it to "Yes" or "yes" then you must NOT configure your own alias(es).</p>
|
|||
|
|
<p><a name="LocalPackets"></a>Note 3: The contents of the "LOCAL"
|
|||
|
|
column determine whether packets originating on the firewall itself and
|
|||
|
|
destined for the EXTERNAL address are redirected to the internal ADDRESS. If
|
|||
|
|
this column contains "yes" or "Yes" (and the ALL
|
|||
|
|
INTERFACES COLUMN also contains "Yes" or "yes") then
|
|||
|
|
such packets are redirected; otherwise, such packets are not redirected. The
|
|||
|
|
LOCAL column was added in version 1.1.8.</p>
|
|||
|
|
</blockquote>
|
|||
|
|
|
|||
|
|
<blockquote>
|
|||
|
|
</blockquote>
|
|||
|
|
|
|||
|
|
<p><font size="2">Last updated 3/27/2002 - </font><font size="2">
|
|||
|
|
<a href="support.htm">Tom
|
|||
|
|
Eastep</a></font> </p>
|
|||
|
|
<font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
|||
|
|
<EFBFBD> <font size="2">2001, 2002 Thomas M. Eastep.</font></a></font><!--mstheme--></font></body></html>
|