This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Full NAT a /24 network?

I need to setup our new firewall at a co-lo with one of our /24 networks, but have been ordered to NAT it to a 10.x.x.x internal network... [[[:(]]]

I would rather not do NAT, but I don't have a choice.

I am under the impression that I need to do the following:

1. have the ISP use 1 of our IPs for their router

2. setup the external interface with an IP on the real Class C network

3. setup another 253 or so "additional addresses" on the external interface
[[[:(]]]

4. setup the 10.x.x.x network on the internal interface

5. setup "Full NAT" for all 253 or so IPs
[[[:(]]]

Am I right?
Is this the only and easiest way?

Are there any shortcuts for #3 and #5? e.g., is there a way to setup a block or subnet for "Full NAT" or "Additional Addresses" without having to do 1 at a time?
I remember some other firewalls having ways to NAT entire ranges (internalexternal) at once.

The Astaro docs indicate that you can put a network into the NAT source or dest, but will it be a 1-1 mapping?
I'm guessing I couldn't do the whole /24 though because of the external IP, but a /25 should work, right?

As mentioned, NAT is a company requirement, so please no arguments about that.

Thanks,
Barry

This thread was automatically locked due to age.

Parents

0 BarryG over 16 years ago

The ISP is giving us a /30 to route our traffic, so I believe the firewall can have an address on that network, and/or our /24.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to BarryG

Barry, I feel like you know a lot more about this stuff than most of us here, so I'm taking a chance that I won't sound too ignorant...

I thought you could set up full NAT on the DNAT/SNAT tab, and that it would work with networks instead of just individual IPs. Have you tried that and determined that it doesn't work?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 liug over 16 years ago in reply to BarryG

I have the same confusion here as to what to put in each fields to setup the full NAT.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago in reply to liug

Since writing here, I've learned that you'd need to do BOTH a DNAT and an SNAT to acheive this.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 eganders_01 over 16 years ago in reply to BarryG

Thanks for the follow-up Barry. Great info!
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago in reply to eganders_01

Also see Gert's post here:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/20441

That sounds like it'd help with what I was trying to do, at least.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 liug over 16 years ago in reply to BarryG

Since writing here, I've learned that you'd need to do BOTH a DNAT and an SNAT to acheive this.

Barry

Doing both DNAT and SNAT will definitely achieve this, but I thought full NAT was there as an easier way to do this, or are you saying full NAT is for some other purposes?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to liug

Yes. Full NAT "broadcasts" your internal IPs and is useful when these IPs are in a public range.
Cancel
Vote Up 0 Vote Down

Cancel
0 liug over 16 years ago in reply to BAlfson

Isn't NAT for translating between public and private IPs?
If these IPs are already in public range, why do one need NAT?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to liug

Sorry about that confused post. Barry, here's my confusion now...

I can see that a full NAT is inapplicable if you have traffic initiated in both directions. If these are web servers, for example, then it seems like a standard DNAT alone would solve the problem of hiding the internal IP. If the issue is hiding the internal IPs for outbound traffic, then it would seem that standard Masquerading does that. How would security be enhanced by having traffic initiated by each specific server appear to come from an address unique to that server?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 16 years ago in reply to BAlfson

Hi Bob,
While there isn't a real security difference, diagnosing problems is often easier when you can easily identify traffic per machine.

Imagine running a sniffer outside the firewall, and trying to figure out which machine is downloading or uploading something.
(I realize you can run _another_ sniffer inside.)

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to BarryG

OK, you said upfront that this was a rule imposed from on-high.

Still, it would be cool if you could achieve a 1-to-1 mapping with similarly sized Networks or Network Groups in D/SNAT. That would go a long way towards simplifying the creation and modification of rules. I have one client that hosts 30 specialized "stores"with 30 separate IPs. It would have been much easier to have one DNAT instead of 30.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 16 years ago in reply to BarryG

OK, you said upfront that this was a rule imposed from on-high.

Still, it would be cool if you could achieve a 1-to-1 mapping with similarly sized Networks or Network Groups in D/SNAT. That would go a long way towards simplifying the creation and modification of rules. I have one client that hosts 30 specialized "stores"with 30 separate IPs. It would have been much easier to have one DNAT instead of 30.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data