Anywhere you go, let me go too

關於部落格
對人海闊天空,做事仔細周密
----------------------
因為改了平台後...覺得不是很好用....所以有另外......(評估中)
http://blog.xuite.net/king119wang/myskills
  • 32543

    累積人氣

  • 2

    今日人氣

    0

    訂閱人氣

HSM經NAT後的iptables 設定

原想會不會是因為NAT後,HSM拿到的是content switch上的IP????

在苦無辦法之下,只好將HSM上的iptables全部設成all accept,結果就可以順利連入,
於是就順便下個netstat的語法來驗證上面推論是否可能發生,結果發現取到的IP就是原本iptables上設定可接受的IP......這下怪了,那為什麼會被HSM拒絕???

後來找網安人員討論,想說有可能是HSM只接受來源IP以某個特定Port連入,後來想想這是有可能的,
因為之前在做與某政府機關做的通訊連線程式,就被限制只能由某個port去發動連線......即在送socket出去時,要限制我要以XXX特定port去連線,他們會驗我們是否由那個特殊port連,如果不是就會被reject.......

後來和HSM廠商討論,確定沒有驗連線的port.........怪了,後來廠商說可能要設定content switch的IP,
但如果要設,為什麼以前中間沒有一層content switch時,也不用設gateway的IP???而且成功連線後看到的IP就是原IP......實在沒理由會被reject才對。

後來就抱著估且一試的心裏,向網安人員問了content switch本機的IP,得到一個對內及對外的IP,
當時我猜是對內的,因為HSM是連在content switch上,縱然它有一個1對1的Map,也應該是對內的,
但是這個IP和HSM是同網段....為什麼要設???不是走broadcast嗎?? ===>原gateway也是broadcast就不用設啊???

經實驗後發現當,真的要加一條content switch實體IP,才能順利連,如果只要對外的IP一樣會有問題,
而此時下netstat去看,一樣只看到source的IP,真的是怪到極點了...... 如果要開放content switch IP那應該有content switch連線的記錄.....但是居然沒有......

這個是該研究一下了,我想了下面幾個方向去求證原因:
1. 要了解NAT原理==>是否在連線的過程中,content switch和HSM是應該有一些勾溝的機制???
    而這個機制是....還沒到tcp/ip Layer????
2. 要iptables的驗證 ===> 是否不是只就ip 封包的source IP做驗證????
....
先把爬到的NAT知識貼上....改天有空再來研究唄!!  (先去趕明天開會的ppt了~)
=====================================
 

NAT in Windows 2003: Setup and Configuration

This article will describe how to setup and configure NAT in Windows 2003. NAT, or Network Address Translation, is a widely used IP translation and mapping protocol that works on the network layer (level 3) of the OSI model. It is sometimes referred to as a routing protocol because of the way it allows packets from a private network to be routed to the Internet.

NAT acts as a middle man between the internal and external network; packets coming from the private network are handled by NAT and then transferred to their intended destination.

A single external address is used on the Internet so that the internal IP addresses are not shown. A table is created on the router that lists local and global addresses and uses it as a reference when translating IP addresses.

NAT can work in several ways:

Static NAT

An unregistered IP address is mapped to a registered IP address on a one-to-one basis - which is useful when a device needs to be accessed from outside the network.

Dynamic NAT

An unregistered IP address is mapped to a registered IP address from a group of registered IP addresses. For example, a computer 192.168.10.121 will translate to the first available IP in a range from 212.156.98.100 to 212.156.98.150.

Overloading



A form of dynamic NAT, it maps multiple unregistered IP addresses to a single registered IP address, but in this case uses different ports. For example, IP address 192.168.10.121 will be mapped to 212.56.128.122:port_number (212.56.128.122:1080).

Overlapping

This when addresses in the inside network overlap with addresses in the outside network - the IP addresses are registered on another network too. The router must maintain a lookup table of these addresses so that it can intercept them and replace them with registered unique IP addresses.

How NAT works

A table of information about each packet that passes through is maintained by NAT.

When a computer on the network attempts to connect to a website on the Internet:

  • the header of the source IP address is changed and replaced with the IP address of the NAT computer on the way out
  • the "destination" IP address is changed (based on the records in the table) back to the specific internal private class IP address in order to reach the computer on the local network on the way back in

Network Address Translation can be used as a basic firewall – the administrator is able to filter out packets to/from certain IP addresses and allow/disallow access to specified ports. It is also a means of saving IP addresses by having one IP address represent a group of computers.

Setting up NAT

To setup NAT you must start by opening the Configure your server wizard in administrative tools and selecting the RRAS/VPN Server role. Now press next and the RRAS setup wizard will open. The screen below shows the Internet Connection screen in which you must specify which type of connection to the Internet and whether or not you want the basic firewall feature to be enabled.

Press next to continue. The installation process will commence and services will be restarted, after which the finish screen will be displayed - showing what actions have taken place.

Configuring NAT

Configuration of NAT takes place from the Routing and Remote Access mmc found in the Administrative Tools folder in the Control Panel or on the start menu.

The screenshot below shows the routing and remote access mmc.

Select which interface you wish to configure and double click it. This will bring up the properties window giving you the option to change settings such as packet filtering and port blocking, as well as enabling/disabling certain features, such as the firewall.

The remote router (set up previously) properties box is shown below. The NAT/Basic Firewall tab is selected.

You are able to select the interface type – to specify what the network connection will be. In my example I have selected for the interface to be a public interface connected to the internet. NAT and the basic firewall option have also been enabled. The inbound and outbound buttons will open a window that will allow you restrict traffic based on IP address or protocol packet attributes. As per your instructions, certain TCP packets will be dropped before they reach the client computer. Thus, making the network safer and giving you more functionality. This is useful if, for example, you wanted to reject all packets coming from a blacklisted IP address or restrict internal users access to port 21 (ftp).

For further firewall configuration, go to the Services and Ports tab. Here you can select which services you would like to provide your users access to. You can also add more services by specifying details such as the incoming and outgoing port number.

The list of services shown in the above screenshot are preset. Press Add to bring up the window that will allow the creation of a new service or select an available service and press Edit to modify that service. You will be asked to specify the name, TCP and UDP port number and the IP address of the computer hosting that service.

If the services in the list aren’t enabled then any client computer on the Windows 2003 domain will not be able to access that specific service. For example, if the computer was configured as shown in the image above and a client computer tried to connect to an ftp site, he would be refused access. This section can prove to be very useful for any sized networks, but especially small ones.

That concludes this article. As you have seen, Network Address Translation is a useful feature that adds diversity and security to a network in a small to medium sized company. With the advent, and implementation, of IPv6 still in its beginning stages, we can expect to see NAT being used for many years to come.

(引用自:http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html)
相簿設定
標籤設定
相簿狀態