- So let's talk about network address translation.
How does network address translation work?
Well, the purpose is to have a private network.
So this network,
the 10.0.0.0 network is considered private network.
And here we have the public site.
You want to protect your private network
and at the same time you wanna make sure
that nodes on your private network
are capable of going outside.
Now, how does that work?
Well, that works by configuring network translation,
network address translation
that is on the outside interface of your router.
So what is going to happen?
Well, in network address translation,
network addresses are translated.
And in order to really understand how that works,
well, we also need to to include some MAC addresses.
So let's say that this is aa, this is MAC address bb
and this is MAC address cc.
This is very much simplified
but we don't really care about MAC addresses
in this drawing.
So it all starts where this node is generating
an outgoing packet.
Let's say that this node is going to IP address, 1.1.1.1,
and the source IP address will be 10.0.0.10.
So this packet is forwarded
according to the default router
and it'll be forwarded to the router.
Now, what is the router going to do?
Well, the router is going to do network address translation.
And this network address translation
is where the router is going to change
the source IP address.
So the router is regenerating the packet
in such a way that it is still addressed
to 1.1.1.1,
but now we have the 192.168.1.1,
it's the source IP address.
And then the packet can go out to the destination.
Now, what is the destination thing?
SO that this packet comes from 192.168.1.1.
So what is a magic of this net trick to really work?
Well, the magic is only understandable
if you throw in some MAC dresses as well.
So in a packet header, there's not just IP addresses,
there is also MAC addresses.
And the thing that is going to happen
is that in the MAC address,
a random MAC addresses generated by the net router.
Let's say that that is dd as the source MAC address
and here we have ee
which is the destination of the internet.
The ee doesn't really matter, the dd does.
What the net router is going to register
is that at the moment
that a packet is going back to this dd address
that it needs to be forwarded to the original note,
which is 10.0.0.10.
So what is happening?
Well, the internet is going to send back a packet.
And while sending back a packet, the the packet is addressed
to 192.168.1.1
coming from the internet IP address 1.1.1.1.
The net router is looking up this packet
in the net table and there it'll find
that the packet needs to be forwarded to 10.0.0.10.
So that means that we still keep the original source
from the internet and we rewrite the packet header
to 10.0.0.10.
And that allows the packet finally
to reach its destination right here.
So what does that bring us?
Well, that brings us that for the internet
anything on the 10 network is not visible,
but still the nodes on the 10 network
by using this network address translation trick
are capable of going out to the internet.
And that's how net is working.
So for this demo, we need two additional servers.
I install server 3, which has an IP address
192.168.29.230 as well as 10.0.0.10.
So this is a multi-home server, it's a router,
and that is what we are going to be configuring
as the net server.
Behind that net server there is server 4
which is listening on IP address 10.0.0.11
which is not directly reachable by the 192.168 servers.
So here on the slide you can see what I'm going to do.
Let me do it for you.
Okay, I'm starting with --firewall cmd.
There's get zones, which is just printing an overview
of the different zones that are available.
So to add the masquerading, I'm gonna use
firewall cmd --zone=public --add-masquerade,
with the permanent option.
So now masquerading is added
and let me do it without a permanent option
to immediately bring it to runtime as well.
Next I'm going to check my zone configuration.
So fire firewall cmd --list-all --zone=public.
I wanna see the configuration for the public zone
and we can see that in the public zone
there is ENS 33.
ENS 33 is the network cart
that's the 192.168 IP address.
And let's also do this for the internal zone
where we can see that ENS 34 is in the internal zone
and that's exactly what we need.
Now, if you have the default configuration,
you may see that both interfaces are in the public zone
and then you can use
this command firewall cmd --zone=internal
change interface is ENS 34.
Good, we don't have to do that because it's already done.
So firewall cmd --get-active-zones.
It's showing the current zone configuration
with the network cards that are in there.
That's just to verify.
So that is cool and that means that I can do the next step,
and the next step
is where we are going to configure the port forwarding
because that's mission of this demo.
We want to make sure that on the firewall server
that is server 3,
a port is forwarded to the SSH service on server 4.
That will be the firewall CMD command.
- -zone=public --add-forward-port=Port=2022:
proto=tcp:toport=22:toaddress=10.0.0.11.
Let's verify.
So add forward port, that's what we need.
And then we have the different arguments,
the different items that need to be configured.
So port is 2022, that is what we are exposing
on the public side of this firewall,
the protocol is TCP, the to port is 22
and the to address is 10.0.0.11.
So that is successful
and if we want it to stay around,
we also need --permanent.
And now we can go to server 1 for testing.
So how do we test?
Simple, ssh student@192.168.29.230 -p 2022.
And well, we can see that we get an answer
from an SSH process,
that's already good news.
So yes, I am sure
and here is my password.
And look at that,
I have a prompt on server 4.
And if I type ip a,
then you can see that we are really on 10.0.0.11.
So that is a combination of port forwarding
with Network Catalyst translation up and running.