Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 4: Understanding Policy Configuration
IP Filter rule basics
126
Limitations of NAT for IP Filter protocols
Note the following limitations when setting up rules involving address rewriting
for TCP/UDP/ICMP protocols.
• NAT and redirection are not allowed for bi-directional IP Filter rules with
stateful packet inspection enabled.
• For address rewrite rules with redirection to the source address, only unidirectional
rules are allowed. Furthermore, the destination address in this
type of rule must have a significant bits value of 32 (that is, it must be a
single host or netmap). This is because the redirect address must be a
single host.
Setting the IP Filter NAT port rewrite range
When a packet from a source reaches the Sidewinder G2 and matches an IP
Filter rule with NAT configured, the source port and source address will be
rewritten and the packet will then be forwarded to its destination.
To facilitate this process, the IP Filter reserves a block of 875 ports for its own
use. The OS will never allow a process to bind to a port in this range. Creating
a TCP generic services proxy in this port range will not work. The default range
is set to 9210—9995.
If you need a port in IP Filter's reserved range (perhaps for a generic proxy),
the range can be moved by modifying the Start of Reserved Ports field in the
IP Filter Properties window. See “Viewing and modifying general IP Filter
properties” on page 241.
It is possible that an existing TCP proxy connection may be using a port in the
range you specify. In this case the cf ipfilter command will fail. You should
look at the current port usage by entering the netstat -a command and
adjust the IP Filter port range accordingly.
Specifying the source port in an IP Filter rule
The Sidewinder G2 enables you to specify the source port value to use in an
TCP or UDP IP Filter connection. This capability is typically only used when
connecting to an application that requires the source port to be a specific
value. (In some cases the application will require the source port to be the
same value as the port on which the application is listening.)
This capability is implemented by configuring NAT on the appropriate IP Filter
rule. This “source port” implementation of NAT, however, is different from a
normal implementation of NAT.