When a response is received, the NAT router searches its translation tables to find the original source address of the packet from which the device on the LAN originally started the connection and thus passes the response to that device. The NAT router then replaces the source address, which is the device’s private address, with its own public address before passing the traffic to its destination on the Internet. When a device on the LAN initiates a connection with a device on the Internet, the device will send all traffic to the NAT router first. When that reply gets back to VM-B, VM-B will drop the traffic because the source IP address is 10.1.1.1 instead of VM-A/192.168.1.1.The way NAT works is in principle rather simple. When VM-A/192.168.1.1 replies back to VM-B/20.1.1.1, T1-A sees that there’s no firewall connection entry, performs SNAT on it, and translates the source IP from VM-A/192.168.1.1 to 10.1.1.1. If T1-A has firewall disabled or stateless, the T1-A firewall will forward the TCP SYN packet from VM-B/20.1.1.1 to VM-A/192.168.1.1 without creating a firewall connection entry, because it’s either stateless or no firewall.This is because the firewall will skip the SNAT lookup when the return traffic matches up with a firewall connection entry. When VM-A replies, T1-A will match the reply packet with the stateful connection entry, and forward the traffic from VM-A/192.168.1.1 to VM-B/ 20.1.1.1 with no SNAT translation. If T1-A has stateful firewall, the T1-A firewall will create a firewall connection entry for the TCP SYN packet from VM-B/20.1.1.1 to VM-A/192.168.1.1.When this NO-NAT rule exists, then there will be no difference in behavior. To have this scenario, configure a NO-NAT rule for traffic matching 192.168.1.0/24 to 20.1.1.0/24. The firewall rules permit the traffic between VM-B and VM-A. Here, there’s a difference in behavior when T1-A has a stateful firewall versus when it has no firewall or stateless firewall. The SNAT rule works as expected, and there are no issues. When the traffic from VM-C or VM-B returns for that flow, they will have a destination IP of 10.1.1.1 T1-A will match it up with the SNAT flow and translate it correctly so that it flows back to VM-A. Any traffic stream that is initiated from VM-A/192.168.1.1 will get translated to 10.1.1.1 as the source IP, regardless if gateway firewall is stateful, stateless, or disabled.
0 kommentar(er)
