Symantec™ Security Gateways Reference Guide - Sawmill

122 Preventing attacksAddress transformsClient non-transparencyWith client non-transparency, the security gateway hides the real IP address of a client from the server bychanging the source IP address in a packet’s header to the IP address of the security gateway’s outsideinterface (src != src’). By doing this, the server believes that the connection request originated from thesecurity gateway. Responses from the server are directed back through the security gateway. Beforeforwarding these responses to the client, the security gateway changes the destination address in thepacket header from the security gateway’s IP address to the client’s real IP address. This looks like Figure 9-1.Figure 9-1Client non-transparencyClient transparencyYou can also configure the security gateway to leave the source IP address unchanged (src = src’). Theconnection still goes through the security gateway, with all appropriate checks enforced, but the serverunderstands the real source of the request, and its responses are sent back to the real IP address, not thesecurity gateway. This is known as client transparency because the security gateway is said to betransparent (invisible) in the connection from the server to the client. This is shown in Figure 9-2.Figure 9-2Client transparency