Translating Both Source And Destination IP

[roadrunner]

Translating Both Source And Destination IP
Contributed by BenSmith
Published in geeklog Wednesday, June 25 2003 @ 07:00 PM EST
Published in oldfaq 02-Nov-23 00:48 dwelchATphoneboyDOTcom

Consider the following situation:

10.0.0.0/24 ---------- FireWall ----------- 192.168.0.0/24

You need to be able to have a few hosts on the 10.0.0.0 network talk to a host on the 192.168.0.0 network. For political and technical reasons, You can not have any 192.168.0.0 IP addresses appear on the 10.0.0.0 network and vice versa.

FireWall-1 can allow you to do this by translating both the source and destination IP addresses, also known as dual address translation. The steps you would need to take are much the same as you do for ordinary NAT (for specific commands, see either Routing and ARP issues with NAT or Sample Configuration with NAT). This means:


Creating an ARP entry on the firewall for 10.0.0.10 using the MAC address for the firewall on the 10.0.0.0 network
Creating a static route on the firewall for 10.0.0.0 to route to the untranslated IP of 192.168.0.10 (e.g. route add 10.0.0.10 192.168.0.10 1)
Create the appropriate network objects and rules<
Add the translated IP address to the appropriate anti-spoofing configuration
Assuming the following objects


Net-10-0-0-0 for the 10.0.0.0/24 network
Host-192-168-0-10 for the host you wish to access on the 192.168.0.0/24 network
Host-10-0-0-10 for the translated IP for 192.168.0.10
fw-hide-192-168-0-1 for the firewall's IP on 192.168.0.0/24
Your NAT rule would look like this:

Original Translated
No. Source Destination Service Source Destination Service
1 Net-10-0-0-0 Host-10-0-0-10 Any fw-hide-192-168-0-1(H) Host-192-168-0-10 Orig


This NAT rule allows any host on the 10.0.0.0/24 network to access 192.168.0.10 using the translated IP address of 192.168.0.10. Those host will appear as 192.168.0.1 on the 192.168.0.10 network.

Note that you will also need to add an appropriate rule to the security policy to permit access to 10.0.0.10.

-- RayLodato - 13 Jan 2004


FAQForm
FAQs.Class: NetworkAddressTranslationFAQs
FAQs.OS:
FAQs.Version: