Configuring NAT in Kerio Control

Overview

Network Address Translation (NAT) is a term used for the exchange of a private IP address in a packet going out from the local network to the Internet with the IP address of the Internet interface of the Kerio Control host. This technology is used to connect local private networks to the Internet by a single public IP address.

Step by Step guide:

Configuring IP address translation

In the Kerio Control administration interface, go to Traffic Rules. IP address translation must be configured for the particular rules.
Double-click Translation in the selected rule.
In the Traffic Rule - Translation dialog, you can configure the following:

Source IP address translation (NAT — Internet connection sharing)

Source address translation is used in traffic rules applied to traffic from the local private network to the Internet. In other rules (traffic between the local network and the firewall, between the firewall and the Internet, etc.), NAT is unnecessary.

For source address translation, check Enable source NAT and select:

Source NAT Type

Description

Default setting (recommended)

By default, in packets sent from the LAN to the Internet the source, IP address will be replaced by IP address of the Internet interface of the firewall through which the packet is sent. This IP address translation method is useful in the general rule for access from the LAN to the Internet because it works correctly in any Internet connection configuration and for any status of individual links.

For a single leased link or connection failover, the following options have no effect on Kerio Control's functionality. If Kerio Control works in the mode of network traffic load balancing, you can select:

Perform load balancing per host — traffic from the specific host in the LAN will be routed via the same Internet link. This method is set as default because it guarantees the same behavior as in the case of clients connected directly to the Internet. However, load balancing dividing the traffic among individual links may be not optimal in this case.
Perform load balancing per connection — the Internet link will be selected for each connection established from the LAN to the Internet to spread the load optimally. This method guarantees the most efficient use of the Internet connection's capacity. However, it might also introduce problems and collisions with certain services. The problem is that individual connections are established from various IP addresses (depending on the firewall's interface from which the packet is sent) which may be considered as an attack at the destination server.

Use specific outgoing interface

Packets will be sent to the Internet via this specific link. This allows the definition of rules for forwarding specific traffic through a selected Interface — so-called policy routing.

If the selected Internet link fails, the Internet will be unavailable for all services, clients, etc. specified by this rule. To prevent such situations, check to Allow using a different interface if this one becomes unavailable.

Use specific IP address

An IP address for NAT will be used as the source IP address for all packets sent from the LAN to the Internet.

It is necessary to use an IP address of one of the firewall's Internet interfaces.
Definition of a specific IP Address cannot be used in combination with network load balancing or connection failover.

Destination NAT (port mapping):

Destination address translation (also called port mapping) is used to allow access to services hosted in private local networks behind the firewall.

For port mapping:

Check Enable destination NAT.
In the field Translate to the following host, type a host address or DNS name. IP address that will substitute the packet's destination address. This address also represents the address/name of the host on which the service is actually running.
If you want to change a port, check Translate port as well and type the service port. During the process of IP translation, you can also substitute the port of the appropriate service. This means that the service can run at a port that is different from the port where it is available from the Internet.

Example

A default NAT rule description:

A typical traffic rule for NAT (Internet connection sharing):

Settings	Description
Source	Group Trusted/Local Interfaces (from the Interfaces section). This group includes all segments of the LAN connected directly to the firewall. If access to the Internet from some segments is supposed to be blocked, the most suitable group to file the interface into is Other interfaces. If the local network consists of cascaded segments (i.e. it includes other routers), it is not necessary to customize the rule in accordance with this fact — it is just necessary to set routing correctly.
Destination	The Internet Interfaces group. With this group, the rule can be used for any type of Internet connection.
Service	This entry can be used to define global limitations for Internet access. If particular services are defined for NAT, only these services will be used for the NAT and other Internet services will not be available from the local network.
Actions	The Action must be set to Allow.
Translation	In the Source NAT section select the Default settings option (the primary IP address of the outgoing interface will be used for NAT). The default option will ensure that the correct IP address and Interface are used for the intended destination. WARNING Destination NAT should not be configured for outgoing rules, except under very unique circumstances.
Placing the rule	The rule for destination address translation must be preceded by all rules which deny access to the Internet from the local network.

Such a rule allows access to the Internet from any host in the local network, not from the firewall itself (i.e. from the Kerio Control host).

Traffic between the firewall and the Internet is enabled by a special rule by default. Since the Kerio Control host can access the Internet directly, it is not necessary to use NAT.

A rule for traffic between the firewall and hosts in the Internet

Choose files or drag and drop files

Tags:

Was this article helpful?

Yes

Priyanka Bhotika
Posted

Comments

Please sign in to comment