The RDR Rule: Allowing External Access to a LAN Computer
The RDR rule flavor allows you to make a computer on your LAN, such as a Web or FTP server, available to Internet users without requiring you to obtain a public IP address for that computer. The computer';s private IP address is translated to your public IP address in all incoming and outgoing data packets.
Without an RDR rule (or Bimap rule), the device prevents attempts by external computers to access your LAN computers.
The following example illustrates using the RDR rule to provide external access to your web server:
Your ADSL/Ethernet router receives a packet containing a request for access to your Web server. The packet header contains the public address for your LAN as the destination IP address, and a destination port number of 80. Because you have set up an RDR rule for incoming packets with destination port 80, the device recognizes the data as a request for Web server access. The device changes the packet';s destination address to the private IP address of your Web server and forwards the data packet to it.
Your Web server sends data packets in response. Before the ADSL/Ethernet router forwards them on to the Internet, it changes the source IP address in the data packets from the Web server';s private address to your LAN';s public address. To an external Internet user then, it appears as if your Web server uses your public IP address.
Follow these instructions to add an RDR rule (see steps 1-4 under "The NAPT Rule" for specific instructions corresponding to steps 1 and 2 below):
Display the NAT Rule-Add Page, select RDR as the Rule Flavor, if necessary, and enter a Rule ID.
Select the interface on which this rule will be effective.
Select a protocol to which this rule applies, or choose ALL.
This selection specifies which type of Internet communication will be subject to this translation rule. You can select ALL if the rule applies to all data. Or, select TCP, UDP, ICMP, or a number from 1-255 that represents the IANA-specified protocol number.
In the Local Address From and Local Address To fields, type the same private IP address, or the lowest and highest addresses in a range:
If you type the same IP address in both fields, incoming traffic that matches the criteria you specify in steps 5 and 6 will be redirected to that IP address.
If you type a range of addresses, incoming traffic will be redirected to any available computer in that range. This option would typically be used for load balancing, whereby traffic is distributed among several redundant servers to help ensure efficient network performance.
These addresses should correspond to private addresses already in use on your network (either assigned statically to your PCs, or assigned dynamically using DHCP, as discussed in Overview of DHCP).
In the Global Address From and Global Address To fields, type the public IP address assigned to you by your ISP.
If you have multiple WAN (PPP) interfaces, this rule will not be enforced for data that arrives on other PPP interfaces.
If you have multiple WAN interfaces and want the rule to be enforced on more than one of them (or all), type the starting and ending IP addresses of the range.
In the Destination Port From and Destination Port To fields, enter the port ID (or a range) that you expect to see on incoming packets destined for the LAN computer for which this rule is being created.
Incoming traffic that meets this rule criteria will be redirected to the Local Port number you specify in the next field.
For example, if you grant public access to a Web server on your LAN, you would expect that incoming packets destined for that computer would contain the port number 80. This setting serves as a filter; data packets not containing this port number would not be granted access to you local computer.
If the LAN computer that you are making publicly available is configured to use a non-standard port number for the type of traffic it receives, type the non-standard port number in the Local Port field.
This option translates the standard port number in packets destined for your LAN computer to the non-standard number you specify. For example, if your Web server uses (non-standard) port 2000, but you expect incoming data packets to refer to (standard) port 80, you would enter 2000 here and 80 in the Destination Port fields. The headers of incoming packets destined for port 80 will be modified to refer to port 2000. The packet can then be routed appropriately to the web server.
Follow steps 8-12 under "The NAPT Rule" to submit your changes.
--------------------------------------------------------------------------------
|
|Archiver|小黑屋|宽带技术网
|网站地图
发表于 2006-7-13 23:29:03