Chapter 21 Appendix A: Operation Commands
117
action The keyword is either permit or deny. if the conditions are matched, it
will do the action specified here
protocol Name of an IP protocol. It can be one of the keywords tcp, udp, or icmp.
To match any Internet protocol, including ICMP, TCP, and UDP, use the
keyword any.
src_ip network address or host from which the packet is being sent. For packets
from any host, use the keyword any.
src_ip_prefix the prefix of the src_ip. If src_ip is any, this parameter can be omitted.
dst_ip network address or host to which the packet is being sent. For packets
sending to any host, use the keyword any.
dst_ip_prefix the prefix of the dst _ip. If dst _ip is any, this parameter can be omitted.
low_port (Optional) The decimal number of a TCP or UDP port. A port number is
a number from 1 to 65535. This parameter is only applied to TCP or
UDP packets.
hi_port (Optional) If the port is a range. Please input the end port number here.
Command: >add napt forwarding
Syntax: add napt forwarding name low_port [hi_port] private_ip
Explanation: add a port forwarding entry. The feature provides for the need to forward packets with
particular port number from the outside to a specified inside local address.
Parameters: name name for this entry
low_port the low port of the port range for this port forwarding entry
hi_port the low port of the port range for this port forwarding entry
private_ip the ip address
Command: >add nat address
Syntax: add nat address index start_addr [end_addr]
Explanation: To define a pool of IP addresses for Network Address Translation
Network Address Translation (NAT) is used to translate an Internet Protocol address (IP
address) used in one network to a different IP address that is used in another network. One
network is designated as the inside network. The other network is designated as the outside
network. Most organizations map their local inside network addresses to one or more
outside network IP addresses. When packets come in from outside networks these
organizations unmap the outside network IP addresses and translate them into the local IP
addresses used on their inside network.
Network Address Translation has further advantages. One is security. Each request
(outgoing or incoming) must go through a translation process and the requests can be
qualified, authenticated, or compared to a previous request. Network Address Translation
also reduces on the number of global IP addresses that an organization needs and allows it
to use a single IP address in its communications with the world.
Network Address Translation can be defined statically, or it can be set up to translate
dynamically to and from a pool of IP addresses. It is included as part of a router and is
often also used in firewalls. It can also be used with policy routing. Network administrators
create tables to do global-to-local and local-to-global IP address mapping.
Parameters: index the pool index. The possible values range from 1 to 8.
start_addr starting IP address that defines the range of addresses in the address pool
end_addr ending IP address that defines the range of addresses in the address pool.
Command: >add nat static
Syntax: add nat static public_ip private_ip
Explanation: Sets up a single static translation. This command establishes the globally unique IP address
of an inside host as it appears to the outside world, i.e. the feature provides for the need to
forward packets from the outside to a specified inside local address.
To Next Page
Loading...
Need help?
General
