Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Figure 52: Example
network
Chapter 4: Understanding Policy Configuration
IP Filter rule basics
Using NAT and redirection for IP Filter rules
Many organizations use network address translation (NAT) and/or redirection
to prevent internal addresses from being visible to external users. On the
Sidewinder G2, NAT refers to rewriting the source address of the packet to the
external address of the Sidewinder G2 (or an address you specify). This allows
you to protect (or hide) the actual client source address, and in the case of
non-routable source addresses (such as 10.0.0.0) rewrite it to an address that
can be routed on the Internet. Redirection refers to rewriting the destination
address of an incoming packet to a redirect host for delivery.
Note: NAT and redirection function independently of one another. For applications
that allow either side of a connection to act as the client, you will generally create
two rules: one using NAT, and one using redirection.
Caution: Allowing IP Filter to pass traffic without NAT or redirection is possible
assuming all addresses are routable. However, it is not recommended because it
will expose internal addresses to the external side of your Sidewinder G2 without
the protection of a proxy.
When NAT or redirection is enabled in a rule, the source address in the rule is
always protected, as follows:
• For a rule of source -> destination, enabling NAT will “hide” the source
address from the destination for traffic originating from the source by
translating that address to the external address of the Sidewinder G2.
• For a rule of source -> redirect address, the destination (or external
Sidewinder G2 address) will be redirected to the actual source address and
hides the redirected address for traffic returning to the source.
Note: NAT or redirection are not allowed for bi-directional IP Filter rules with
stateful inspection enabled.
For the following scenarios, assume your network looks like this:
172.17.0.0
internal network
172.17.129.130 10.11.12.13
Sidewinder G2
192.101.0.0
external network
125