Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 84)

Chapter 7 Traﬃc Policy

Figure 7.14 Traﬃc rule — selecting an action

Translation

Source or/and destination IP address translation.

Source IP address translation (NAT — Internet connection sharing)

The source IP address translation can be also called IP masquerading or Internet connection

sharing. The source (private) IP address is substituted by the IP address of the interface

connected to the Internet in outgoing packets routed from the local network to the Internet.

Therefore, the entire local network can access the Internet transparently, but it is externally

considered as one host.

Source address translation is used in traﬃc rules applied to traﬃc from the local private

network to the Internet. In other rules (traﬃc between the local network and the ﬁrewall,

between the ﬁrewall and the Internet, etc.), NAT is meaningless. For detailed information and

examples of rules, refer to chapter 7.4.

For source address translation, WinRoute oﬀers these options:

Automatic IP address selection

By default, in packets sent from the LAN to the Internet the source IP address will be

replaced by IP address of the Internet interface of the ﬁrewall through which the packet

is sent. This IP address translation method is useful in the general rule for access from the

LAN to the Internet (see chapter 7.4), because it works correctly in any Internet connection

conﬁguration and for any status of individual links (for details, see chapter 6).

If WinRoute works in the mode of network traﬃc load balancing (see chapter 6.4), you

can select a method which will be used for spreading the traﬃc between the LAN and the

Internet over individual Internet links:

• Load balancing per host — all traﬃc from the speciﬁc host (client) in the LAN will

always be routed via the same Internet link. All connections from the client will be

established from the same source IP address (the public address of the particular

interface of the ﬁrewall). This method is set as default, because it guarantees the

same behavior as in case of clients connected directly to the Internet. However,

1 2 ... 79 80 81 82 83 84 85 86 87 88 89 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 84