Dnat

These scenarios show how to configure DNAT (Destination Network Address Translation) on OSDx.

Test DNAT 

Description 

In this scenario, DUT0 modifies the destination address of incoming packets generated at the WAN side. The address is translated to a custom one: 192.168.100.2.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.100.2
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.0.0.2 8080 tcp

Step 7: Initiate a udp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 10.0.0.2 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=10.0.0.22 dst=10.0.0.2
src=192.168.100.2 dst=10.0.0.22

Test DNAT Redirect 

Description 

This scenario is similar to the previous one, but when redirect is specified the destination address is NATed to the interface IP.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat destination rule 1 address redirect
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 4: Initiate a tcp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 192.168.100.3 8080 tcp

Step 5: Initiate a udp connection from DUT1 to DUT0 and exchange messages between both endpoints

admin@DUT0$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 192.168.100.3 5050 udp

Step 6: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=10.0.0.22 dst=192.168.100.3
src=10.0.0.2 dst=10.0.0.22

Test DNAT Port Forwarding 

Description 

In this scenario, DNAT forwards incoming TCP traffic destined to a specific port. Requests arriving at 10.0.0.2:80 are translated to 192.168.100.2:8080.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.100.2
set interfaces ethernet eth1 traffic nat destination rule 1 port 8080
set interfaces ethernet eth1 traffic nat destination rule 1 protocol tcp
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 destination port 80
set traffic selector SEL rule 1 protocol tcp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.0.0.2 80 tcp

Step 7: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=10.0.0.22 dst=10.0.0.2
src=192.168.100.2 dst=10.0.0.22
dport=80
sport=8080

Test DNAT Address Pool 

Description 

In this scenario, DNAT translates the destination of incoming packets to one address from a pool. The kernel selects the target address per connection.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.100.2-192.168.100.3
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set interfaces ethernet eth0 address 192.168.100.3/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 192.168.100.3 from DUT0:

admin@DUT0$ ping 192.168.100.3 count 1 size 56 timeout 1

Step 6: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 7: Initiate a tcp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.0.0.2 8080 tcp

Step 8: Initiate a udp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 10.0.0.2 5050 udp

Step 9: Run the command system conntrack show nat on DUT0 and check whether the output matches the following regular expressions:

src=10.0.0.22 dst=10.0.0.2
src=192.168.100.[23] dst=10.0.0.22

Test DNAT Network Prefix 

Description 

In this scenario, DNAT translates the destination using a network prefix. The host part of the original IP address is kept, but the network part is mangled using a subnet prefix.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.100.1/24
set interfaces ethernet eth1 address 10.0.0.2/24
set interfaces ethernet eth1 traffic nat destination rule 1 network 192.168.100.0/24
set interfaces ethernet eth1 traffic nat destination rule 1 selector SEL
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic selector SEL rule 1 protocol tcp,udp

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 10.0.0.22/24
set protocols static route 0.0.0.0/0 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.100.2/24
set protocols static route 0.0.0.0/0 next-hop 192.168.100.1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping the IP address 192.168.100.2 from DUT0:

admin@DUT0$ ping 192.168.100.2 count 1 size 56 timeout 1

Step 5: Ping the IP address 10.0.0.22 from DUT0:

admin@DUT0$ ping 10.0.0.22 count 1 size 56 timeout 1

Step 6: Initiate a tcp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 8080 tcp
admin@DUT1$ monitor test connection client 10.0.0.2 8080 tcp

Step 7: Initiate a udp connection from DUT1 to DUT2 and exchange messages between both endpoints

admin@DUT2$ monitor test connection server 5050 udp
admin@DUT1$ monitor test connection client 10.0.0.2 5050 udp

Step 8: Run the command system conntrack show nat on DUT0 and check whether the output contains the following tokens:

src=10.0.0.22 dst=10.0.0.2
src=192.168.100.2 dst=10.0.0.22