F3215-HP Load Balancing Module Network Management Configuration Guide-6PW101
96
You can configure an internal server on the NAT device by mapping a public IP address and port number
to the private IP address and port number of the internal server. For instance, you can configure an
address like 20.1.1.12:8080 as an internal Web server's external address and port number.
In Figure 54,
when the NAT device receives a packet destined for the public IP address of an internal
ser
ver, it looks in the NAT entries and translates the destination address and port number in the packet
to the private IP address and port number of the internal server. When the NAT device receives a
response packet from the internal server, it translates the source private IP address and port number of the
packet into the public IP address and port number of the internal server.
Figure 54 Internal server operation
DNS mapping
Generally, the DNS server and users that need to access internal servers reside on the public network.
You can specify an external IP address and a port number for an internal server on the public network
interface of a NAT device, so that external users can access the internal server using its domain name or
pubic IP address. In Figure 55, an inter
nal ho
st wants to access an internal Web server by using its
domain name, when the DNS server is located on the public network. Typically, the DNS server replies
with the public address of the internal server to the host and thus the host cannot access the internal server.
The DNS mapping feature can solve the problem.
Figure 55 Operation of NAT DNS mapping
A DNS mapping entry records the domain name, public address, public port number, and protocol type
of an internal server. Upon receiving a DNS reply, the NAT-enabled interface matches the domain name
in the message against the DNS mapping entries. If a match is found, the private address of the internal
server is found and the interface replaces the public IP address in the reply with the private IP address.
Then, the host can use the private address to access the internal server.
192.168.1.3
192.168.1.1 20.1.1.1
1.1.1.2
NAT
Intranet
Internet
Host
Server
Dst : 20.1.1.1:8080Dst : 192.168.1.3:8080
Src : 192.168.1.3:8080
Src : 20.1.1.1:8080
Before NAT
20.1.1.1:8080
After NAT
192.168.1.3:8080
Direction
Inbound