Technology, Computer, Network and Games Cheat » Router

Configuring NAT on the Cisco PIX or ASA firewalls.

Andrew Lin — Thu, 30 Apr 2009 15:28:33 +0000

If you do not want to expose your server’s IP address to an external client you can use Network Address Tranalation (NAT) to hide it. For example if your servers IP address is 192.168.0.10 then you can publish it to an external client as 10.0.0.10. The reason you would do this is to enhance the security of your server, you want to make the hacker earn their self pride or whatever it is that motivates them.

There are many ways to achieve this, NAT, VIP, MIP etc. In this article I will explain NAT (natting) on a Cisco PIX, ASA or router.

First you need to log onto the firewall or router. Enter en (enable) to get into the privilege mode, you will then be prompted for the password. Enter Config T to get into the configure terminal mode. You can now start confguring the network appliance.

Below is what your should see in the running config after you complete the configuration.

static (inside,outside) 172.210.10.10 11.12.13.10 netmask 255.255.255.255 0 0

The above line means that the IP address 172.210.10.10 (outside interface) is mapped to 11.12.13.10 (inside interface). Clients in the outside interface will connect to resources on 11.12.13.10 by referencing the natted (NAT) IP 172.210.10.10.

You also need to configure the access list or policy to allow traffic from the outside interface to flow into the inside interface. The access list then needs to be applied to the outside intefrace.

access-list Allowed_Traffic permit tcp host any host 172.210.10.10 eq www log

The above means that the name of the access list is Allowed_Traffic. Permit TCP traffic from any host to 172.210.10.10, only allow if service request is for www (TCP port 80), and log all traffic.

You then need to apply the access list to the outside interface.

access-group Allowed_Traffic in interface outside

Typical Windows DHCP Server Scope Options

Andrew Lin — Tue, 28 Apr 2009 21:31:48 +0000

Here is a list of typical DHCP server scope options that I usually configure on the Windows DHCP server.

003 Routers
006 DNS Servers
015 DNS Domain Name
249 Classless Static Routes

The DCHP server automatically assigns unique IP addresses to any computer that wishes to connect to the LAN. Before DHCP came along the network administrator has to configure static IP on each computer, server and printer. This was fine as long as the network was small, but can you imagine manually assigning IP addresses to hundreds of network resources. The other week I met up with a former colleague for lunch and I was shocked to learn that the health care unit that he worked for was still assigning IPs manually. Perhaps there is a good reason for this, but my firend was not able to tell me why.

When configuring the DHCP server you must add the scope option # 003 for Router. This is the gateway IP address for your LAN. The gateway is required for the computers on the LAN to communicate with external resources, typically the internet. It is possible to have multiple gateways, such as a redundant gateway route.

Option # 006 DNS Server, you got to have this as well. Domain Name System Server resolves host/domain names to an IP address. When you enter www.gamescheat.ca in your browser, your computer queries the DNS server which then responds with the IP address of the website, for example IP address 10.10.11.211. It would be very hard for you to remember the IP address of all the websites on the internet, hence the need for DNS server.

Option # 015 DNS Domain Name, if your company has a domain name such as gamescheat.ca, then this is where you would configure this.

Option # 249 Classless Static Routes, this is very helpful when you have multiple routes on the network that is handled by more than one different gateways. This is different from the default route of 0.0.0.0 with a mask of 0.0.0.0, you only need option 003 for default route. With Classless Static Routes you can define a subnet mask, unlike the default route. For example 10.11.21.0 mask 255.255.255.0 to 10.11.21.10.

NAT, Network Address Translation

Andrew Lin — Fri, 02 Mar 2007 04:29:03 +0000

Last night or early this morning I had to stay my and work on a new network connectivity with a financial institution. I am not going to name the institution but will only say that it is one of the largest financial institution in the USA.

At the scheduled 1 a.m. eatern time, I dialed into the conference bridge and connected with 3 other parties. This was a new circuit we were trying to implement from Phoenix to New Jersey. I am in Toronto, Ontario and the rest of the people were in the US. The circuit was a frame-relay circuit, CIR of 64k and burstable to 128k, good old reliable frame-relay but pain in the behind to implement and configure.

Anyhow, what I really wanted to discuss here is NAT (network address translation).Â NAT hides the real source of IP address and converts it to a different IP. For excample if you have multiple computers that want to share one single internet connection, you can do this with NAT. Your ISP assigns you one public IP, but you have more than one computer that accesses the internet. You will need to purchase a router to share the internet connection, if you do not have a router there are other ways to do this as well.Â

How does NAT work? Well in the above example, say computer A is 10.0.0.2 and computer B is 10.0.0.3. The router is connected to the internet and has a public ip of 70.64.238.1. When computer A accessing www.cupidpost.com, via the router, the router will translate the ip address 10.0.0.2 to 70.64.238.1 and direct the connection to www.cupidpost.com. If computer B accessing the internet at the same time a computer A, the router will translate the IP 10.0.0.3 to 70.64.238.1 as well.