summaryrefslogtreecommitdiff
path: root/docs/configuration/nat/nat44.rst
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configuration/nat/nat44.rst')
-rw-r--r--docs/configuration/nat/nat44.rst176
1 files changed, 133 insertions, 43 deletions
diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst
index b2ba61af..98b230a9 100644
--- a/docs/configuration/nat/nat44.rst
+++ b/docs/configuration/nat/nat44.rst
@@ -148,23 +148,35 @@ rule.
* **outbound-interface** - applicable only to :ref:`source-nat`. It
configures the interface which is used for the outside traffic that
- this translation rule applies to.
+ this translation rule applies to. Interface groups, inverted
+ selection and wildcard, are also supported.
- Example:
+ Examples:
.. code-block:: none
- set nat source rule 20 outbound-interface eth0
+ set nat source rule 20 outbound-interface name eth0
+ set nat source rule 30 outbound-interface name bond1*
+ set nat source rule 20 outbound-interface name !vtun2
+ set nat source rule 20 outbound-interface group GROUP1
+ set nat source rule 20 outbound-interface group !GROUP2
+
* **inbound-interface** - applicable only to :ref:`destination-nat`. It
configures the interface which is used for the inside traffic the
- translation rule applies to.
+ translation rule applies to. Interface groups, inverted
+ selection and wildcard, are also supported.
Example:
.. code-block:: none
- set nat destination rule 20 inbound-interface eth1
+ set nat destination rule 20 inbound-interface name eth0
+ set nat destination rule 30 inbound-interface name bond1*
+ set nat destination rule 20 inbound-interface name !vtun2
+ set nat destination rule 20 inbound-interface group GROUP1
+ set nat destination rule 20 inbound-interface group !GROUP2
+
* **protocol** - specify which types of protocols this translation rule
applies to. Only packets matching the specified protocol are NATed.
@@ -273,6 +285,42 @@ Example:
set nat destination rule 10 translation address 192.0.2.10
+Also, in :ref:`destination-nat`, redirection to localhost is supported.
+The redirect statement is a special form of dnat which always translates
+the destination address to the local host’s one.
+
+Example of redirection:
+
+.. code-block:: none
+
+ set nat destination rule 10 translation redirect port 22
+
+NAT Load Balance
+----------------
+
+Advanced configuration can be used in order to apply source or destination NAT,
+and within a single rule, be able to define multiple translated addresses,
+so NAT balances the translations among them.
+
+NAT Load Balance uses an algorithm that generates a hash and based on it, then
+it applies corresponding translation. This hash can be generated randomly, or
+can use data from the ip header: source-address, destination-address,
+source-port and/or destination-port. By default, it will generate the hash
+randomly.
+
+When defining the translated address, called ``backends``, a ``weight`` must
+be configured. This lets the user define load balance distribution according
+to their needs. Them sum of all the weights defined for the backends should
+be equal to 100. In oder words, the weight defined for the backend is the
+percentage of the connections that will receive such backend.
+
+.. cfgcmd:: set nat [source | destination] rule <rule> load-balance hash
+ [source-address | destination-address | source-port | destination-port
+ | random]
+.. cfgcmd:: set nat [source | destination] rule <rule> load-balance backend
+ <x.x.x.x> weight <1-100>
+
+
Configuration Examples
======================
@@ -287,7 +335,7 @@ demonstrate the following configuration:
.. code-block:: none
- set nat source rule 100 outbound-interface 'eth0'
+ set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address 'masquerade'
@@ -296,7 +344,9 @@ Which generates the following configuration:
.. code-block:: none
rule 100 {
- outbound-interface eth0
+ outbound-interface {
+ name eth0
+ }
source {
address 192.168.0.0/24
}
@@ -388,19 +438,19 @@ Example:
set nat destination rule 100 description 'Regular destination NAT from external'
set nat destination rule 100 destination port '3389'
- set nat destination rule 100 inbound-interface 'pppoe0'
+ set nat destination rule 100 inbound-interface name 'pppoe0'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '192.0.2.40'
set nat destination rule 110 description 'NAT Reflection: INSIDE'
set nat destination rule 110 destination port '3389'
- set nat destination rule 110 inbound-interface 'eth0.10'
+ set nat destination rule 110 inbound-interface name 'eth0.10'
set nat destination rule 110 protocol 'tcp'
set nat destination rule 110 translation address '192.0.2.40'
set nat source rule 110 description 'NAT Reflection: INSIDE'
set nat source rule 110 destination address '192.0.2.0/24'
- set nat source rule 110 outbound-interface 'eth0.10'
+ set nat source rule 110 outbound-interface name 'eth0.10'
set nat source rule 110 protocol 'tcp'
set nat source rule 110 source address '192.0.2.0/24'
set nat source rule 110 translation address 'masquerade'
@@ -416,7 +466,9 @@ Which results in a configuration of:
destination {
port 3389
}
- inbound-interface pppoe0
+ inbound-interface {
+ name pppoe0
+ }
protocol tcp
translation {
address 192.0.2.40
@@ -427,7 +479,9 @@ Which results in a configuration of:
destination {
port 3389
}
- inbound-interface eth0.10
+ inbound-interface {
+ name eth0.10
+ }
protocol tcp
translation {
address 192.0.2.40
@@ -440,7 +494,9 @@ Which results in a configuration of:
destination {
address 192.0.2.0/24
}
- outbound-interface eth0.10
+ outbound-interface {
+ name eth0.10
+ }
protocol tcp
source {
address 192.0.2.0/24
@@ -479,7 +535,7 @@ Our configuration commands would be:
set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'
set nat destination rule 10 destination port '80'
- set nat destination rule 10 inbound-interface 'eth0'
+ set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'
@@ -494,7 +550,9 @@ Which would generate the following NAT destination configuration:
destination {
port 80
}
- inbound-interface eth0
+ inbound-interface {
+ name eth0
+ }
protocol tcp
translation {
address 192.168.0.100
@@ -510,43 +568,45 @@ Which would generate the following NAT destination configuration:
This establishes our Port Forward rule, but if we created a firewall
policy it will likely block the traffic.
-It is important to note that when creating firewall rules that the DNAT
+Firewall rules for Destination NAT
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+It is important to note that when creating firewall rules, the DNAT
translation occurs **before** traffic traverses the firewall. In other
words, the destination address has already been translated to
192.168.0.100.
-So in our firewall policy, we want to allow traffic coming in on the
-outside interface, destined for TCP port 80 and the IP address of
-192.168.0.100.
+So in our firewall ruleset, we want to allow traffic which previously matched
+a destination nat rule. In order to avoid creating many rules, one for each
+destination nat rule, we can accept all **'dnat'** connections with one simple
+rule, using ``connection-status`` matcher:
.. code-block:: none
- set firewall name OUTSIDE-IN rule 20 action 'accept'
- set firewall name OUTSIDE-IN rule 20 destination address '192.168.0.100'
- set firewall name OUTSIDE-IN rule 20 destination port '80'
- set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
- set firewall name OUTSIDE-IN rule 20 state new 'enable'
+ set firewall ipv4 forward filter rule 10 action accept
+ set firewall ipv4 forward filter rule 10 connection-status nat destination
+ set firewall ipv4 forward filter rule 10 state new enable
This would generate the following configuration:
.. code-block:: none
- rule 20 {
- action accept
- destination {
- address 192.168.0.100
- port 80
- }
- protocol tcp
- state {
- new enable
+ ipv4 {
+ forward {
+ filter {
+ rule 10 {
+ action accept
+ connection-status {
+ nat destination
+ }
+ state {
+ new enable
+ }
+ }
+ }
}
}
-.. note::
-
- If you have configured the `INSIDE-OUT` policy, you will need to add
- additional rules to permit inbound NAT traffic.
1-to-1 NAT
----------
@@ -574,10 +634,10 @@ and one external interface:
set interfaces ethernet eth1 description 'Outside interface'
set nat destination rule 2000 description '1-to-1 NAT example'
set nat destination rule 2000 destination address '192.0.2.30'
- set nat destination rule 2000 inbound-interface 'eth1'
+ set nat destination rule 2000 inbound-interface name 'eth1'
set nat destination rule 2000 translation address '192.168.1.10'
set nat source rule 2000 description '1-to-1 NAT example'
- set nat source rule 2000 outbound-interface 'eth1'
+ set nat source rule 2000 outbound-interface name 'eth1'
set nat source rule 2000 source address '192.168.1.10'
set nat source rule 2000 translation address '192.0.2.30'
@@ -592,6 +652,40 @@ provide access to their internal resources, and require that a
connecting organisation translate all traffic to the service provider
network to a source address provided by the ASP.
+Load Balance
+------------
+Here we provide two examples on how to apply NAT Load Balance.
+
+First scenario: apply destination NAT for all HTTP traffic comming through
+interface eth0, and user 4 backends. First backend should received 30% of
+the request, second backend should get 20%, third 15% and the fourth 35%
+We will use source and destination address for hash generation.
+
+.. code-block:: none
+
+ set nat destination rule 10 inbound-interface name eth0
+ set nat destination rule 10 protocol tcp
+ set nat destination rule 10 destination port 80
+ set nat destination rule 10 load-balance hash source-address
+ set nat destination rule 10 load-balance hash destination-address
+ set nat destination rule 10 laod-balance backend 198.51.100.101 weight 30
+ set nat destination rule 10 laod-balance backend 198.51.100.102 weight 20
+ set nat destination rule 10 laod-balance backend 198.51.100.103 weight 15
+ set nat destination rule 10 laod-balance backend 198.51.100.104 weight 35
+
+Second scenario: apply source NAT for all outgoing connections from
+LAN 10.0.0.0/8, using 3 public addresses and equal distribution.
+We will generate the hash randomly.
+
+.. code-block:: none
+
+ set nat source rule 10 outbound-interface name eth0
+ set nat source rule 10 source address 10.0.0.0/8
+ set nat source rule 10 load-balance hash random
+ set nat source rule 10 load-balance backend 192.0.2.251 weight 33
+ set nat source rule 10 load-balance backend 192.0.2.252 weight 33
+ set nat source rule 10 load-balance backend 192.0.2.253 weight 34
+
Example Network
^^^^^^^^^^^^^^^
@@ -639,12 +733,10 @@ NAT Configuration
set nat source rule 110 description 'Internal to ASP'
set nat source rule 110 destination address '172.27.1.0/24'
- set nat source rule 110 outbound-interface 'any'
set nat source rule 110 source address '192.168.43.0/24'
set nat source rule 110 translation address '172.29.41.89'
set nat source rule 120 description 'Internal to ASP'
set nat source rule 120 destination address '10.125.0.0/16'
- set nat source rule 120 outbound-interface 'any'
set nat source rule 120 source address '192.168.43.0/24'
set nat source rule 120 translation address '172.29.41.89'
@@ -670,14 +762,12 @@ external interface in the image above)
.. code-block:: none
- set vpn ipsec ike-group my-ike ikev2-reauth 'no'
set vpn ipsec ike-group my-ike key-exchange 'ikev1'
set vpn ipsec ike-group my-ike lifetime '7800'
set vpn ipsec ike-group my-ike proposal 1 dh-group '14'
set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group my-ike proposal 1 hash 'sha256'
- set vpn ipsec esp-group my-esp compression 'disable'
set vpn ipsec esp-group my-esp lifetime '3600'
set vpn ipsec esp-group my-esp mode 'tunnel'
set vpn ipsec esp-group my-esp pfs 'disable'
generated by cgit v1.2.3 (git 2.39.1) at 2025-12-31 19:41:03 +0000