Network Address Translation (NAT) is a term used for the exchange of a private IP address in a packet going out from the local network to the Internet with the IP address of the Internet interface of the Kerio Control host. This technology is used to connect local private networks to the Internet by a single public IP address.
Step by Step guide:
Configuring IP address translation
- In the Kerio Control administration interface, go to Traffic Rules. IP address translation must be configured for the particular rules.
- Double-click Translation in the selected rule.
- In the Traffic Rule - Translation dialog, you can configure the following:
Source IP address translation (NAT — Internet connection sharing)
Source address translation is used in traffic rules applied to traffic from the local private network to the Internet. In other rules (traffic between the local network and the firewall, between the firewall and the Internet, etc.), NAT is unnecessary.
For source address translation, check Enable source NAT and select:
Source NAT Type
|Default setting (recommended)||
By default, in packets sent from the LAN to the Internet the source, IP address will be replaced by IP address of the Internet interface of the firewall through which the packet is sent. This IP address translation method is useful in the general rule for access from the LAN to the Internet because it works correctly in any Internet connection configuration and for any status of individual links.
For a single leased link or connection failover, the following options have no effect on Kerio Control's functionality. If Kerio Control works in the mode of network traffic load balancing, you can select:
|Use specific outgoing interface||
Packets will be sent to the Internet via this specific link. This allows the definition of rules for forwarding specific traffic through a selected Interface — so-called policy routing.
If the selected Internet link fails, the Internet will be unavailable for all services, clients, etc. specified by this rule. To prevent such situations, check to Allow using a different interface if this one becomes unavailable.
|Use specific IP address||
An IP address for NAT will be used as the source IP address for all packets sent from the LAN to the Internet.
Destination NAT (port mapping):
Destination address translation (also called port mapping) is used to allow access to services hosted in private local networks behind the firewall.
For port mapping:
- Check Enable destination NAT.
- In the field Translate to the following host, type a host address or DNS name. IP address that will substitute the packet's destination address. This address also represents the address/name of the host on which the service is actually running.
- If you want to change a port, check Translate port as well and type the service port. During the process of IP translation, you can also substitute the port of the appropriate service. This means that the service can run at a port that is different from the port where it is available from the Internet.
A default NAT rule description:
A typical traffic rule for NAT (Internet connection sharing):
Group Trusted/Local Interfaces (from the Interfaces section). This group includes all segments of the LAN connected directly to the firewall. If access to the Internet from some segments is supposed to be blocked, the most suitable group to file the interface into is Other interfaces.
If the local network consists of cascaded segments (i.e. it includes other routers), it is not necessary to customize the rule in accordance with this fact — it is just necessary to set routing correctly.
The Internet Interfaces group. With this group, the rule can be used for any type of Internet connection.
This entry can be used to define global limitations for Internet access. If particular services are defined for NAT, only these services will be used for the NAT and other Internet services will not be available from the local network.
The Action must be set to Allow.
In the Source NAT section select the Default settings option (the primary IP address of the outgoing interface will be used for NAT). The default option will ensure that the correct IP address and Interface are used for the intended destination.
Destination NAT should not be configured for outgoing rules, except under very unique circumstances.
|Placing the rule||
The rule for destination address translation must be preceded by all rules which deny access to the Internet from the local network.
Such a rule allows access to the Internet from any host in the local network, not from the firewall itself (i.e. from the Kerio Control host).
Traffic between the firewall and the Internet is enabled by a special rule by default. Since the Kerio Control host can access the Internet directly, it is not necessary to use NAT.
A rule for traffic between the firewall and hosts in the Internet