Reflection and Hairpin NAT

Networks used in this How-To section

NAT - Quick Overview

Because there are not enough available IPv4 addresses, a workaround called NAT (Network Address Translation) was implemented into the IPv4 Standard. It basically enables a router like the Ixolate to translate IPv4 addresses to other IPv4 addresses. Most of the time it is used to translate the limited external IPv4 address space to the shared internal IPv4 address space (RFC 1918, 192.168.0.0/16 - 172.16.0.0/12 - 10.0.0.0/8) and vice versa.

Note

Note

SNAT - Source Network Address Translation

• Changes the source IP of a packet
• Firewall --\> NAT --\> Source NAT (Outbound) using the option Translate Source IP in a rule

DNAT - Destination Network Address Translation

• Changes the destination IP of a packet
• Firewall --\> NAT --\> Destination NAT (Port Forward) using the option Redirect target IP in a rule

PAT - Port Address Translation

• Changes the destination port of a packet
• Firewall --\> NAT --\> Destination NAT (Port Forward) using the option Redirect target port in a rule

If you create a DNAT rule, you enable all clients in the WAN access to an internal IPv4 address. The Ixolate acts like a translator, translating IPv4 addresses between client and server. The Ixolate writes all translations into a file called the NAT table. It knows exactly how traffic should flow back and forth with the translations in place.

Introduction to Reflection and Hairpin NAT

For example, you have a Webserver example.com with the internal IP 172.16.1.1 in your DMZ. It has a public DNS Record of example.com in A 203.0.113.1.

Your internal client 192.168.1.1 can’t reach the Webserver if it resolves the DNS A-Record 203.0.113.1. When the Ixolate receives the packet from the client 192.168.1.1 with the destination IP 203.0.113.1, it chooses itself as the target, and not 172.16.1.1. That’s because the external IPv4 address 203.0.113.1 is mapped to the WAN interface of the Ixolate.

That’s where Reflection NAT comes into play. It creates NAT rules which help your internal client 192.168.1.1 to communicate with your webserver 203.0.113.1, by using the Ixolate as the “translator” to the actual destination 172.16.1.1.

Attention

Attention

You should choose your preferred Reflection NAT method from the three possible choices presented here. They’re exclusive to each other, picking one method and sticking to it will prevent mistakes.

• Method 1 - Creating manual Port-Forward NAT (DNAT), manual Source NAT (SNAT), and automatic firewall rules
• Method 2 - Creating automatic Port-Forward NAT (DNAT), manual Source NAT (SNAT), and manual firewall rules
• Method 3 - Creating automatic Port-Forward NAT (DNAT), automatic Source NAT (SNAT), and manual firewall rules

Best Practice

The best way to do Reflection NAT in the Ixolate is not to use the legacy Reflection options in /manual/firewall_settings. Creating the NAT rules manually with Method 1 prevents unwanted traffic and makes auditing easy. There will be no hidden rules. All rules will be perfectly visible in the GUI and .xml config exports.

Start of the How-To Section:

The goal is to access the Webserver 172.16.1.1 on port 443 with it’s external IP 203.0.113.1 from a client in WAN, LAN and DMZ.

Method 1 - Creating manual Port-Forward NAT (DNAT), manual Source NAT (SNAT), and automatic firewall rules

Go to Firewall › Settings › Advanced
Disable Reflection for Destination NAT (Port Forwards), Reflection for 1:1 and Automatic Source NAT (Outbound) for Reflection

Go to Firewall › NAT › Destination NAT (Port Forward)
Select + to create a new Destination NAT (Port Forward) rule.

Attention

Attention

Now you have Reflection NAT. The traffic from the internal LAN client 192.168.1.1 and any WAN client reaches the Webserver. But there is a caveat - any DMZ client and the Webserver itself are still unable reach the external IP 203.0.113.1. For that you need Hairpin NAT, which involves an additional SNAT rule.

Go to Firewall › NAT › Source NAT (Outbound)
Select Hybrid Source NAT rule generation and save. That way you can have manual Source NAT rules in conjunction with automatic IP-Masquerading rules. You could also choose Manual Source NAT rule generation. Please make sure that you create your own IP-Masquerading rules with manual Source NAT enabled.

Select + to create a new Source NAT rule.

Repeat Method 1 until all additional servers are reachable.

If you encounter any issues, check Troubleshooting NAT Rules for a few tips.

Method 2 - Creating Automatic Port-Forward NAT (DNAT), Manual Source NAT (SNAT), and Manual firewall rules

Go to Firewall › Settings › Advanced
Enable Reflection for Destination NAT (Port Forwards) to create automatic rules for all entries Firewall › NAT › Destination NAT (Port Forward) that have WAN as interface.

Go to Firewall › NAT › Destination NAT (Port Forward)
Create the NAT rule as in Method 1 - Destination NAT (Port Forward) but change the following things:

• Make sure that your Destination NAT (Port Forwarding) rule specifies only WAN as interface.

Go to Firewall › Rules › Floating

Go to Firewall › NAT › Source NAT (Outbound)
Create the NAT rule as in Method 1 - Source NAT

Method 3 - Creating Automatic Port-Forward NAT (DNAT), Automatic Source NAT (SNAT), and Manual firewall rules

Go to Firewall › Settings › Advanced
Enable Reflection for Destination NAT (Port Forward)s to create automatic rules for all :menuselection: Firewall --\> NAT --\> Destination NAT (Port Forward) that have WAN as interface. Enable Automatic Source NAT (Outbound) for Reflection to create automatic SNAT rules.

Go to Firewall › NAT › Destination NAT (Port Forward)
Create the NAT rule as in Method 2 - Destination NAT (Port Forward)

Go to Firewall › Rules › Floating
Create the floating firewall rule as Method 2 - Floating

One-to-One NAT Reflection

When Firewall › Settings › Advanced Reflection for 1:1 is activated, automatic Reflection NAT rules for all One-to-One NAT rules are generated.

If you want to create manual Reflection and Hairpin NAT rules, leave Reflection for 1:1 disabled and follow the steps in Method 1. The only change is not adding the WAN interface to the Destination NAT (Port Forward) rules you create. The resulting Destination NAT (Port Forward) and Source NAT rules are in addition to the existing One-to-One NAT rules.

If your Destination NAT (Port Forward) rule has 1 interface selected (e.g. LAN), the resulting Filter rule association: Add associated filter rule will appear in Firewall › Rules › LAN. If you have more than 1 interface selected, it will appear in Firewall --\> Rules --\> Floating.

Troubleshooting NAT Rules