FireBrick 105
Manuals
Home

Address mapping

Address mapping allows a change to be made to the ports and IP addresses of traffic going via the FireBrick. This is the same principle as NAT, but allows more specific changes to be made. All new sessions are put through the address mapping table, and the first applicable entries is used.

Name	Allows you to give a name to this rule
Security	Sets the security level of this rule and so defines who can view or edit the users details
Profile	Defines the profile when this rule applies
Source	This allows you to specify one or more source interfaces from which the traffic comes from
Target	This allows you to specify one of more target interfaces to which the traffic was originally being sent (after any routing)
Map traffic to	This defines the new interface to which the traffic is to be sent
Weight	For advanced use
Source ports	This allows a range of source ports to be specified. Applicable to TCP and UDP. Normally blank meaning any.
Target ports	This allows a range of target ports to be specifiied. Applicable to TCP and UDP. Typically just one port for the specific protocol, e.g. 80 for WWW
Protocol	This allows the specific protocol to be specified, or Any.
Port group	Instead of using a source port range, target port range and protocol, then a named port group can be selected.
Source IP range	Allows the range of source IPs to be specified, or blank for any.
Source IP group	Instead of an IP range, a named IP group can be selected.
Target IP range	Allows the range of target IPs to be specified, or blank for any.
Target IP group	Instead of an IP range, a named IP group can be selected.
New target port	This allows the target port to be changed. Leave blank for no change
New source IP	This allows the source IP to be changed. Leave blank for no change. Set to 255.255.255.255 to cause NAT.
New target IP	This allows the target IP to be changed.

Technical Reference

Both stealth and routed traffic is considered, and any mapped traffic becomes routed.
Filters are applied before the traffic is mapped
If a mapping rule matches, then routing is re-done with the new target IP, ports, etc.
Speed lanes are applied to the pre-mapped IP and ports, but the mapped target interface
If there is mapping entry the the routing table is reconsidered
If a target IP range is specified (not an IP group) then the new target IP defines the value mapped for the first of the target range specified. The next is the new IP plus one and so on. i.e. a block of target IPs is remapped to a blank of new IPs. If this is not required then use an IP group to specifyc the range.
Setting the new interface to a partial interface, e.g. just WAN with no subnet selected, will restrict the routing rules considered to be on that interface.
Setting the new interface to Any will allow the routing rules to decide the new target interface
Setting the new source IP to 255.255.255.255 causes the FireBrick to use NAT, using an IP appropriate for the subnet on which is eventually sends the packet.
See Weighted rules for details on how to use the Weight option. This applies only with the bonding feature.