Networks used in this How-To section
| Interface | IPv4 Subnet | Hosts | Gateway |
|---|---|---|---|
| WAN | 203.0.113.0/24 |
203.0.113.1 - Ixolate |
203.0.113.254 - Ixolate |
| DMZ | 172.16.1.0/24 |
172.16.1.1 - Webserver |
172.16.1.254 - Ixolate |
| LAN | 192.168.1.0/24 |
192.168.1.1 - Client |
192.168.1.254 - Ixolate |
NAT - Quick Overview
Because there are not enough available IPv4 addresses, a workaround called NAT (Network Address Translation) was implemented into the IPv4 Standard. It basically enables a router like the Ixolate to translate IPv4 addresses to other IPv4 addresses. Most of the time it is used to translate the limited external IPv4 address space to the shared internal IPv4 address space (RFC 1918, 192.168.0.0/16 - 172.16.0.0/12 - 10.0.0.0/8) and vice versa.
If you create a DNAT rule, you enable all clients in the WAN access to an internal IPv4 address. The Ixolate acts like a translator, translating IPv4 addresses between client and server. The Ixolate writes all translations into a file called the NAT table. It knows exactly how traffic should flow back and forth with the translations in place.
Introduction to Reflection and Hairpin NAT
For example, you have a Webserver example.com with the internal IP 172.16.1.1 in your DMZ. It has a public DNS Record of example.com in A 203.0.113.1.
Your internal client 192.168.1.1 can’t reach the Webserver if it resolves the DNS A-Record 203.0.113.1. When the Ixolate receives the packet from the client 192.168.1.1 with the destination IP 203.0.113.1, it chooses itself as the target, and not 172.16.1.1. That’s because the external IPv4 address 203.0.113.1 is mapped to the WAN interface of the Ixolate.
That’s where Reflection NAT comes into play. It creates NAT rules which help your internal client 192.168.1.1 to communicate with your webserver 203.0.113.1, by using the Ixolate as the “translator” to the actual destination 172.16.1.1.
Best Practice
The best way to do Reflection NAT in the Ixolate is not to use the legacy Reflection options in Firewall settings. Creating the NAT rules manually with Method 1 prevents unwanted traffic and makes auditing easy. There will be no hidden rules. All rules will be perfectly visible in the GUI and .xml config exports.
Start of the How-To Section:
The goal is to access the Webserver 172.16.1.1 on port 443 with it’s external IP 203.0.113.1 from a client in WAN, LAN and DMZ.
Method 1 - Creating manual Port-Forward NAT (DNAT), manual Source NAT (SNAT), and automatic firewall rules
Go to Firewall › Settings › Advanced
Disable Reflection for Destination NAT (Port Forwards), Reflection for 1:1 and Automatic Source NAT (Outbound) for Reflection
Go to Firewall › NAT › Destination NAT (Port Forward)
Select + to create a new Destination NAT (Port Forward) rule.
| Interface: | Select WAN, DMZ and LAN - Select all interfaces in which clients are that should access the webserver. This will create a linked Firewall rule in Firewall › Rules › Floating which allows the traffic. |
| Protocol: | Select TCP |
| Source: | Select Any |
| Source port range: | Select Any |
| Destination: | Input 203.0.113.1 - It’s the external IPv4 address of the webserver. |
| Destination port range: | Input 443 - Or select the alias HTTPS |
| Redirect target IP: | Input 172.16.1.1 - It’s the Webserver’s internal IPv4 address in the DMZ. |
| Redirect target port: | Input 443 - Or select the alias HTTPS |
| Description: | Input Reflection NAT Rule Webserver 443 - Add a description because the linked Filter rule association will use that as its name and the Firewall › Rules › Floating rule will have it in the description. |
| NAT reflection: | Use system default |
| Filter rule association: | Add associated filter rule |
Go to Firewall › NAT › Source NAT (Outbound)
Select Hybrid Source NAT rule generation and save. That way you can have manual Source NAT rules in conjunction with automatic IP-Masquerading rules. You could also choose Manual Source NAT rule generation. Please make sure that you create your own IP-Masquerading rules with manual Source NAT enabled.
Select + to create a new Source NAT rule.
| Interface: | Select DMZ - It’s the interface of the subnet the Webserver is in. |
| Protocol: | Select TCP |
| Source Address: | Select DMZ net - It’s the alias for the DMZ Network 172.16.1.0/24 |
| Source Port: | Select Any |
| Destination Address: | Input 172.16.1.1 - It’s the Webserver’s internal IPv4 address in the DMZ. |
| Destination Port: | Input 443 - Or select the alias HTTPS |
| Translation/target: | Select DMZ address - It’s the alias for the Ixolate Interface IPv4 address 172.16.1.254 in the DMZ Network. |
| Description: | Input Hairpin NAT Rule Webserver 443 |
Repeat Method 1 until all additional servers are reachable.
If you encounter any issues, check Troubleshooting NAT Rules for a few tips.
Method 2 - Creating Automatic Port-Forward NAT (DNAT), Manual Source NAT (SNAT), and Manual firewall rules
Go to Firewall › Settings › Advanced
Enable Reflection for Destination NAT (Port Forwards) to create automatic rules for all entries Firewall › NAT › Destination NAT (Port Forward) that have WAN as interface.
Go to Firewall › NAT › Destination NAT (Port Forward)
Create the NAT rule as in Method 1 - Destination NAT (Port Forward) but change the following things:
- Make sure that your Destination NAT (Port Forwarding) rule specifies only
WANas interface.
Go to Firewall › Rules › Floating
| Action: | Select Pass |
| Interface: | Select WAN, DMZ and LAN - Select all interfaces in which clients are that should access the webserver. |
| Protocol: | Select TCP |
| Source: | Select Any |
| Destination: | Input 172.16.1.1 - It’s the Webserver’s internal IPv4 address in the DMZ. NAT matches before firewall. |
| Destination port range: | Input 443 - Or select the alias HTTPS |
| Description: | Input Reflection NAT Rule Webserver 443 |
Go to Firewall › NAT › Source NAT (Outbound)
Create the NAT rule as in Method 1 - Source NAT
Method 3 - Creating Automatic Port-Forward NAT (DNAT), Automatic Source NAT (SNAT), and Manual firewall rules
Go to Firewall › Settings › Advanced
Enable Reflection for Destination NAT (Port Forward)s to create automatic rules for all :menuselection: Firewall --\> NAT --\> Destination NAT (Port Forward) that have WAN as interface. Enable Automatic Source NAT (Outbound) for Reflection to create automatic SNAT rules.
Go to Firewall › NAT › Destination NAT (Port Forward)
Create the NAT rule as in Method 2 - Destination NAT (Port Forward)
Go to Firewall › Rules › Floating
Create the floating firewall rule as Method 2 - Floating
One-to-One NAT Reflection
When Firewall › Settings › Advanced Reflection for 1:1 is activated, automatic Reflection NAT rules for all One-to-One NAT rules are generated.
If you want to create manual Reflection and Hairpin NAT rules, leave Reflection for 1:1 disabled and follow the steps in Method 1. The only change is not adding the WAN interface to the Destination NAT (Port Forward) rules you create. The resulting Destination NAT (Port Forward) and Source NAT rules are in addition to the existing One-to-One NAT rules.
If your Destination NAT (Port Forward) rule has 1 interface selected (e.g. LAN), the resulting Filter rule association: Add associated filter rule will appear in Firewall › Rules › LAN. If you have more than 1 interface selected, it will appear in Firewall --\> Rules --\> Floating.