Network Address Translation (NAT) Rules

---

Note -

You can use NAT with SKIP to provide communication in an encrypted tunnel (secure virtual private network). The encryption at the source tunnel address must take place after the NAT mapping and decryption at the destination tunnel address must take place before the NAT translation.

---

The following information describes using the administration GUI. Appendix A contains information about the command line interface.

NAT Mapping Overview

You use the NAT tab to set up mapping rules that translate IP addresses according to specific rules. These rules interpret the source and destination address of incoming IP packets, then translate either the apparent source or the intended destination, and send the packets on. You can map hosts, lists of addresses, ranges of addresses, or specific groups, depending on what you have configured in your SunScreen installation.

Rules make up the map that is used during the translation of a packet. In general, you would translate addresses to:

• Ensure that internal addresses appear as registered addresses on the Internet

• Send traffic for a specific destination to a different, pre-determined destination.

When defining NAT rules, the first rule (lowest number) that matches a packet applies, and no other rules can apply. Therefore, you might define specific rules first, then broader cases later.

You can define the mappings of internal addresses to external addresses. Use the NAT tab in the Policy Rules area of the Policy Rules page to specify the address that is to be translated to a particular address, and to select whether you want static mapping or dynamic mapping. Additional information on NAT is in the SunScreen Reference Manual.

All network address translations happen before a packet is tested against any of the screening rules. In this way, you can define all screening rules using only internal addresses. The four addresses NAT supports are:

• Source

• Destination

• Translated Source

• Translated Destination

NAT Administration Page

The meanings and uses of the specific fields in the NAT page are as follows:

Table 4-1 NAT Page Field Explanations

Field	Use
No	Use this field to assign a number to a rule. By default, this field displays a number that is one greater than the last rule, which indicates the rule is placed at the end of the list. If you type a specific number, the new rule is inserted into that position in the list, and the rules in the policy are consequently renumbered.
Screen (Optional)	Use this field to specify the Screen for which you want the rule to apply. Enter a specific Screen name in this field if you use Centralized Management and want a rule to apply to a specific Screen. If a Screen isn't specified, the rule applies for all Screens that are defined.  If Centralized Management is in place, each NAT rule must be associated explicitly with the Screen to which it applies.
Mapping	Static Specify static mapping to set up a one-to-one relationship between two addresses. Static mapping could be used to set new apparent IP addresses for hosts on your network without having to reconfigure each host. Dynamic Specify dynamic mapping to map source addresses to other addresses in a many-to-one relationship. Dynamic mapping could be used to ensure that all traffic leaving the firewall appears to come from a specific address or group of addresses, or to send traffic intended for several different hosts to the same actual IP access.
Source	Specify the source address to map from an untranslated packet. Source addresses are the actual addresses contained in the packet entering the firewall.
Destination	Specify the destination address for the untranslated packet. Destination addresses are the actual addresses contained in the packet entering the firewall.
Translated Source	Specify the translated source address for a packet. The address the packet appears to originate from is the translated source.
Translated Destination	Specify the translated destination address for a packet. The translated destination is the actual address the packet goes to when it leaves the firewall.  It is not possible to translate both source and destination addresses. That is, you cannot make packets appear to come from a different IP address and to simultaneously direct the packets to a different destination.
Description	Use this field to provide a description of the rule.

All NAT rules are unidirectional. They work precisely as defined and are not interpreted as also applying in the reverse direction. So, if you map an internal source address to an external source address, and you want the mapping to apply in the reverse direction, you must map the external destination address to the internal destination address with a second rule.

Your NAT Scenario

When building security policies using NAT, define the security policy rules in terms of internal addresses. All packets that are destined for external addresses used in NAT must be routed to the Screen.

---

Note -

If you use static NAT to map a machine's address, a machine on any other network can initiate traffic to that machine, given a properly-defined reverse rule.

---

Because in routing mode (unlike stealth mode), the Screen does not automatically answer ARP requests for destination address, the Screen must either route to a separate network that has a destination address, or an ARP request must be added manually.

Static NAT is a one-to-one mapping of the internal address to an external address, and dynamic NAT is many-to-one or many-to-few mapping of internal addresses to an external address.

For more information on NAT and the possible set up, see the SunScreen Reference Manual.

---

Note -

Do not include the address of a remote Administration Station in any of your NAT rules, where NAT will occur between the Administration station and the Screen.

---

---

Note -

If Centralized Management is in place, each NAT rule must be associated explicitly with the Screen to which it applies.

---

To Add ARP Manually on a Screen in Routing Mode

Type the following if the networks that attach to the Screen on the inside have NAT mappings applied, including any network on which there are addresses to which you want to allow public access:

# arp -s IP_Address ether_address pub

---

Note -

You must add this entry each time that you reboot the Screen, so you may want to modify a Startup script to do this automatically when you reboot. This is not necessary in stealth mode.

---

To Define NAT Rules

When defining a static NAT mapping, be sure that:

• The ranges and groups used in the Source and Translated Source fields are exactly the same size.

• The ranges and groups used in the Destination and Translated Destination fields are exactly the same size.

1. Select the NAT tab in the Policy Rules area of the Policy Rules page to move to the Network Address Translation area.

   Figure 4-9 Network Address Translation Area

   
   

2. Click New... in the Add New... choice list below the Network Address Translation area to display the NAT Definition dialog window.

   Figure 4-10 NAT Definition Dialog Window

   
   

3. Select the Screen that should use NAT mapping.

   Default is NAT available for all Screens.

4. Select all four addresses in the NAT Definition dialog window.

5. Click the OK button.

6. Repeat the previous steps until you have edited all the rules as required.

7. Click the Save Changes button to save the edited mappings to a file.

   You must click the Activate button for the changes take effect.

   In most cases, when defining a static mapping, the internal address and external address are each a single address.

To Edit the NAT Rules

1. Select the NAT tab in the Policy Rules area of the Policy Rules page to move to the Network Translation area.

2. Click the Mapping field to choose the mapping on the table that you want to edit.

3. Click the Edit button below the Network Address Translation area to display the NAT Definition dialog window for that mapping.

4. Click the down arrow on the Mapping field to display the list of mappings.

5. Click and highlight the type of mapping that you want.

   In most cases when defining a static mapping, the Source Address and Destination Address are each a single address.

6. Click the down arrow on the Source Address field to display the list of addresses.

7. Click and highlight the address that you want.

   The new source address appears in the Source Address field.

8. Click the down arrow on the Destination Address field to display the list of addresses.

   1. Click and highlight the address that you want.

   2. Click and highlight the translated source that you want.

   3. Click and highlight the translated destination that you want.

   The new destination address appears in the Destination Address field.

9. Click the OK button of the NAT Definition dialog window to save your edits.

10. Repeat the previous steps until you have edited all the mappings as required.

11. Click the Save Changes button to save the edited mappings to a file.

    You must click the Activate button for the changes take effect.

Example: Static NAT of a Host to a Host

The following example translates the address of laguna to nathost for all destination addresses for all outgoing traffic.

Figure 4-11 Static Translation of a Host To a Host

Example: Reverse Rule

The following example translates the address nathost to laguna for all source addresses for all incoming traffic. One-way communication is allowed, so one of these rules may be used without the other.

Figure 4-12 The Reverse Rule

Example: Dynamic Translation of a Range Of Addresses to One Host

In the following example, the translation occurs only when the destinations match what is in the internet address group. If the address was not in this group, the source address would not be translated.

Figure 4-13 Dynamic Translation