Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 88)

Chapter 7 Traﬃc Policy

Destination NAT (port mapping):

Destination address translation (also called port mapping) is used to allow access to services

hosted in private local networks behind the ﬁrewall. All incoming packets that meet deﬁned

rules are re-directed to a deﬁned host (destination address is changed). This actually “moves”

to the Internet interface of the WinRoute host (i.e. IP address it is mapped from). From the

client’s point of view, the service is running on the IP address from which it is mapped (usually

on the ﬁrewall’s IP address).

Options for destination NAT (port mapping):

Figure 7.18 Traﬃc rule — destination address translation

• No Translation — destination address will not be modiﬁed.

• Translate to — IP address that will substitute the packet’s destination address. This

address also represents the IP address of the host on which the service is actually

running.

The Translate to entry can be also speciﬁed by DNS name of the destination computer.

In such cases WinRoute ﬁnds a corresponding IP address using a DNS query.

Warning

We recommend you not to use names of computers which are not recorded in the local

DNS since rule is not applied until a corresponding IP address is found. This might

cause temporary malfunction of the mapped service.

• Translate port to — during the process of IP translation you can also substitute the

port of the appropriate service. This means that the service can run at a port that is

diﬀerent from the port where it is available from the Internet.

Note: This option cannot be used unless only one service is deﬁned in the Service entry

within the appropriate traﬃc rule and this service uses only one port or port range.

For examples of traﬃc rules for port mapping and their settings, refer to chapter 7.4.

Log

The following actions can be taken to log traﬃc:

• Log matching packets — all packets matching with rule (permitted, denied or dropped,

according to the rule deﬁnition) will be logged in the Filter log.

• Log matching connections — all connections matching this rule will be logged in the

Connection log (only for permit rules). Individual packets included in these connec-

tions will not be logged.

1 2 ... 83 84 85 86 87 88 89 90 91 92 93 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 88