Chapter 6 Traffic Policy

know DNS name of your host, use the Resolve button to translate the DNS name to IP address.

Warning: The IP address must be assigned to an interface (bound by TCP/IP stack) of the WinRoute host!

Destination address translation (also called port mapping) is used to allow access to services hosted behind the firewall. All incoming packets that meet defined rules are re-directed to a defined host (destination address is changed). This actually “moves” to the outbound interface of the WinRoute host (i.e. IP address it is mapped from). From the client’s point of view, the service is running on the IP address of the Firewall.

Options for destination NAT (port mapping):

Figure 6.20 Traffic rule — destination address translation

No Translation — destination address will not be modified.

Translate to — IP address that will substitute the packet’s destination address. This address also represents the IP address of the host on which the service is actually running.

The Translate to entry can be also specified by DNS name of the destination computer. In such cases WinRoute finds a corresponding IP address using a DNS query.

Warning: We recommend you not to use names of computers which are not recorded in the local DNS since rule is not applied until a corresponding IP address is found. This might cause temporary malfunction of the mapped service.

Translate port to — during the process of IP translation you can also substitute the port of the appropriate service. This means that the service can run at a port that is different from the port from which it is mapped.

Note: This option cannot be used unless only one service is defined in the Service entry within the appropriate traffic rule and this service uses only one port or port range.

The following columns are hidden by the default settings of the Traffic Policy dialog:

104

Page 104
Image 104
Kerio Tech Firewall6 manual 104, 20 Traffic rule destination address translation