Port Translation based on Source Address

From: Chuck (kris_chucky_at_hotmail.com)
Date: 11/08/04 

Date: 7 Nov 2004 23:09:33 -0800

I've heard that some firewalls / nat routers are capable of carrying
out port translation based on source address.

Example:

* The public address of my border firewall is 50.60.70.80
* I want to configure a nat/pat to forward port 22 from the public
source address 30.30.30.80 to my inside device 192.168.5.1, and
requests from all other public source addresses to be handled by the
router itself (ie not natted).

Apparently this is possible on Microsoft ISA & OpenBSD, but as far as
I know
Cisco can't do it, for example in cisco you would just type:
   ip nat inside source static tcp 192.168.5.1 22 interface
<interfacename> 22

and that would nat ALL traffic directed at port 22 of it's public ip
address to the inside device 192.168.5.1, ie you can't differentiate
based on source address.

If anyone can write on their experience with this on Cisco, ISA,
Checkpoint, OpenBSD or anything else that would be great.

regards
KC

Relevant Pages

  • Re: NAT is not a mechanism for securing a network.. but.. HELP!
    ... >> one of their firewalls). ... >> But there was one claim that sounded like a serious problem for NAT ... >> device opens a port by putting it in the NAT table, ... way into the network? ...
    (comp.security.firewalls)
  • Re: any suggestion for a good hardware firewall
    ... Besides being ICSA-certified firewalls, they ... > most certainly do much more than NAT. ... multiple subnets on each LAN or DMZ port - you would use something like ... this in between the Plant Floor network and the Business Office network, ...
    (comp.security.firewalls)
  • Re: Need for firewall when machines are behind a NAT router ?
    ... > fill up my car with gas and all I want to know is what a firewall on a ... Some firewalls like Windows ... protocols like FTP that assign random port numbers on the fly. ... firewalls can do some things that NAT routers and firewall devices cannot, ...
    (microsoft.public.security.virus)
  • Re: ISPs can easily decrease net abuse
    ... |use NAT with forwarding? ... When one of the inside systems wants to go out, the NAT device has to ... address to as it sends out the packets. ... Suppose the NAT box allocates port ...
    (comp.security.misc)
  • Re: How did they get past my NAT?
    ... network), I get no response, because there is no "Default host" set up ... behind my NAT, and no port forwarding for that port - if an explicit ... as I understand?), and not forwarded on the router, so there should be ...
    (comp.security.firewalls)
Loading