HOW TO Configure NAT for a Small Office and a Web Server

This document explains how to use Network Address Translation (NAT) to connect a single machine with a single public (outside) IP address, while simultaneously NAT'ing other multiple machines to a different Internet IP address. This type of configuration is common for many small offices running an internal web server. The features used in this HOW TO are STATIC NAT and MASQUERADE NAT.

Network Address Translation (NAT) is most often used to allow a large number of machines to connect to the Internet using a single IP address. Often a service provider will assign a small group of IP addresses (4 - 16 addresses) to a site which needs to connect multiple computers (30 or more computers) to the Internet.

Note: Throughout this document, the addresses 10.192.192.0 - 255 will be used to represent the "public IP address block". The IP address 192.168.0.0 - 255 will be used to represent the "private IP address block". For more information on public and private IP addressing see RFC 1918 (ftp://ftp.rfc-editor.org/in-notes/rfc1918.txt) or the Vyatta Knowledge Base Entry "Public and Private IP Addresses Explained".
Please be sure to replace the addresses used for this document with the addresses assigned by your Internet Service Provider (ISP).

PROCEDURE

Configure the primary IP addresses on the outside interface
Configure the secondary IP address on the outside interface
Configure the primary IP address on the inside interface
Configure a default gateway
Configure outbound STATIC NAT rule
Configure an inbound STATIC NAT rule
Configure an outside MASQUERADE rule
Test the configuration

1. Configure the primary IP address on the outside interface

Configuration of the primary IP address of the router on the outside interface sets up the router to connect to the Internet. This is also the address which will be used in for the MASQUERADE section of the NAT. Many hosts on the inside of the network will use this IP address when connecting to the Internet.

set interfaces ethernet eth0 address 10.192.192.2 prefix-length 24

2. Configure the secondary IP address on the outside interface

The secondary IP address on the outside interface is the Internet-facing IP address of the web server.

set interfaces ethernet eth0 address 10.192.192.84 prefix-length 24

3. Configure the primary IP address on the inside interface

The primary IP address on the inside interface will be the IP address on the local office LAN. This address will be used as the default gateway for all PC's on the local network.

set interfaces ethernet eth1 address 192.168.0.1 prefix-length 24

4. Configure the a default gateway

The default gateway is an address which is assigned by an Internet Service Provider (ISP) to a customer. The default gateway address is the IP address of the router at the ISP which will receive all traffic destined for the Internet.

set system gateway-address 10.192.192.1

5. Configure the outbound STATIC NAT rule

The outbound STATIC NAT rule configures the Vyatta router to send all traffic it receives from the web server's address on the office LAN using the outside address of the web server on the Internet.

set service nat rule 13
set service nat rule 13 type source
set service nat rule 13 outbound-interface eth0
set service nat rule 13 protocols all
set service nat rule 13 source address 192.168.0.17
set service nat rule 13 destination network 0.0.0.0/0
set service nat rule 13 outside-address address 10.192.192.84

6. Configure an inbound STATIC NAT rule

The inbound STATIC NAT rule configures the Vyatta router to send all traffic it receives from the Internet on the outside address of the web server to its inside address.

set service nat rule 14
set service nat rule 14 type destination
set service nat rule 14 inbound-interface eth0
set service nat rule 14 protocols all
set service nat rule 14 source network 0.0.0.0/0
set service nat rule 14 destination address 10.192.192.84
set service nat rule 14 inside-address address 192.168.0.17

7. Configure an outside MASQUERADE rule

The outside MASQUERADE rule configures the Vyatta router to send any traffic from the office LAN to the Internet using the outside IP address of the Vyatta router. MASQUERADE is used only for outbound traffic. Traffic which is part of an outbound session which originated from the office LAN will be associated with the originating host.

set service nat rule 20
set service nat rule 20 type masquerade
set service nat rule 20 outbound-interface eth0
set service nat rule 20 protocols all
set service nat rule 20 source network 192.168.0.0/24
set service nat rule 20 destination network 0.0.0.0/0

8. Test the configuration

Using a web browser go to a site such as http://www.whatismyip.com/ from the STATIC NAT'ed machine, in this case the web server. The IP address which should appear is 10.192.192.84.

Using a web browser go to http://www.whatismyip.com/ from a MASQUERADEd machine, in this case any machine on the office LAN which is not the web server. The IP address which should appear is 10.192.192.1.



MORE INFORMATION

For more information about the Vyatta CLI see the Vyatta website at: http://www.vyatta.com/documentation

For more information on RFC 1918: ftp://ftp.rfc-editor.org/in-notes/rfc1918.txt

Vyatta Knowledge Base "Public and Private IP Addresses Explained"



REFERENCES

RFC 1918: ftp://ftp.rfc-editor.org/in-notes/rfc1918.txt



LAST REVISED

25-NOV-2007 - spk



Applies to Product

Vyatta Software - Not Hardware Specific
Vyatta 514
Non-Vyatta Hardware
Vyatta 2501


Applies to Software

v2.3.1
v2.3
v2.2

Read More

Protocol Analyser

A Protocol Analyser is an invaluable piece of software that takes the strain out of managing a network. Using an easy to use interface you can 'see' where your packets are going... and where they're not. Using features such as top-talker, a Protocol Analyser will tell you who or what is using up valuable network resources, when, where and why.

Protocol Analysers capture conversations between two or more systems or devices. A Protocol Analyser not only captures the traffic, it also decodes (interprets) the traffic. Decoding allows you to view the conversation in English, as opposed to binary language. A sophisticated Protocol Analyser will also provide statistics and trend information on the captured traffic. Protocol Analysers provide information about the traffic flow on your LAN/WAN, from which you can view device-specific information. Unlike SNMP-based management consoles, Protocol Analysers are device independent.

Why use a NetFlow Analyser instead of a Protocol Analyser ?

Who, What, When and Where: Scrutinizer provides historical trends of the company's critical network interfaces as well as the details on:

Who: The end system causing the traffic
What: The application/protocol that is being used
When: The time frame it has been occurring for
Where: The network connection that is affected
Result: If something is consuming excessive bandwidth the end system can be identified quickly, without utilising a packet analyser.

Today, NetFlow Analysis is the ideal solution

Scrutinizer uses your existing NetFlow capable routers and switches to report on top applications and top hosts on specific interfaces. It provides details on how much bandwidth is being consumed by each of these variables from protocols per user to users per protocol. Because Scrutinizer uses NetFlow technology on your existing routers, you never have to deploy or maintain probes. Scrutinizer goes beyond simple utilization graphs and tools like MRTG.

How Protocol Analysers are Useful

A Protocol Analyser is a tool that shows you exactly what is happening on your LAN. Once a problem is isolated and recorded, there can be no denying which vendor, or which system is the cause.

For example, if your TCP/IP sessions are "hanging", a Protocol Analyser can show which system sent the last packet, and which system failed to respond. If you are experiencing slow screen updates, a Protocol Analyser can display delta time stamps and show which system is waiting for packets, and which system is slow to respond.

In an NT environment, a Protocol Analyser can show runaway traffic (broadcast or multicast storms) and its origin, system errors and retries, and whether a station is sending, trying to send, or only seeming to communicate. You will get information that is otherwise unavailable, which results in more efficient troubleshooting and better LAN health.

Read More

Another Philips Xenium handset unveiled - X700

Just when we talked about the Xenium X530, we spotted another Philips device. It’s the clamshell-shaped X700, which comes with an ultra powerful battery — up to 720 hours in stand-by (1 month!) and 450 minutes in talk-time mode — and again, lacks 3G connectivity.

Rest of the specs include quad-band GSM radio, 2.4-inch QVGA internal and 2-inch QVGA external screens, 3.2 megapixel camera, Bluetooth 2.0, media player, FM radio with RDS. Size wise, the X700 measures 103×54x15 mm.

Finally, you may want to know something about availability. The Philips Xenium X700 is slated to hit China and select European markets (Russia, Romania and Turkey), where interested buyers will be able to grab it for 170 EUR, which is about $220…

Read More

A light-weight system monitor

Conky is a free, light-weight system monitor for X, that displays any information on your desktop. Conky is licensed under the GPL and runs on Linux and BSD.

There is always plenty to be done, such as adding new features, testing, writing docs et cetera. If you're interested in contributing, please feel free to do so by using the handy tools on the sourceforge project page, including the mailing lists. You can get the latest code by cloning the anonymous git repo like so:

$ git clone git://git.omp.am/conky.git

Read More

GreenHopper

Innovative and intuitive management tool for Atlassian's JIRA allowing bug tracking, issue tracking and project management. The main goals of this plugin are to provide JIRA users with the following:

* An interactive and simple interface to manage their projects
* Tools to increase the visibility and traceability of ongoing versions

Planning board (Documentation)

* Global view of all unreleased versions
* Global view of all components
* Card and List look & feel
* Multi-level planning (hierarchical)
* Issue ordering using drag-and-drop
* Issue planning using drag-and-drop
* Multi-selection in the planning board
* Coherent handling of sub-tasks
* Issue filtering and sorting
* Quick access to the issue navigator
* And much more...
Task board (Documentation)

* Intuitive tracking of versions
* Outlined Task board
* Personal board
* Configurable swimlanes
* Update of the issue status using drag-and-drop
* Quick logging of your work
* Quick access to the issue navigator
* Issue filtering and sorting
Search board

* Global view of search results
* Direct access to the issue board
Chart board (Documentation)

* Dynamic and requiring no settings
* Display of the burndown curve
* Display of the team effort curve
* Display of the estimation accuracy curve
* Burndown chart based on a custom field
* Burnup chart based on a custom field
* Value chart based on a custom field
* Issue filtering
* Configurable start date and end date
Card view

* Configurable New!
* Pro-active security
* Concise view of the issue
* Editable issue field values
* Addable comments and work logs
* Watchable value
Plugin Support (Documentation) New!

* Add your own card menu item
* Support of the Balasmiq plugin
* Support of the Link Hiearchy Report plugin
* Support of the Whiteboard plugin

Read More

Award-Winning Agile Lifecycle Management Solutions

Rally is the leader in Agile application lifecycle management (ALM) dedicated to making leaner development organizations that respond faster to changing customer needs. According to a study by QSM Associates, teams that rely on Rally’s Agile lifecycle management products and services are 50% faster to market and 25% more productive than industry averages.

From pilot projects to distributed, multi-team programs, Rally’s family of Agile lifecycle management solutions gives teams the visibility and collaboration needed to formalize and scale Agile development practices that deliver high-value software in rapid iterations.

Rally unites Agile project management with requirements management, test management and defect management, so everyone has a real-time picture of your project’s features and quality, priorities, roadblocks and risks. Rally’s deep support for all roles and activities in the software development lifecycle lets you replace expensive and poorly integrated point tools with a highly secure, hosted web service that starts fast and scales easily across platforms and geographies for low-risk, low-cost deployment.
Scale from small projects to distributed, multi-team programs

Rally offers two editions to match the right functionality with your company's size and stage of Agile development.

* Rally Community Edition makes it easy for smaller teams or pilot teams to manage releases and iterations without undue overhead and complexity. Rally Community is free for up to 10 users and includes Agile project management, requirements management, test management and defect management for a single release team.
* Move to Rally Enterprise Edition to smoothly coordinate the additional roles, tools and dependencies in multi-team programs or cross-cutting initiatives. Rally Enterprise is a complete solution for the software development lifecycle that supports multi-team Agile development with integrations to existing systems and is available in both on-demand and on-premise deployment options.

Read More

To unblock a publisher

What do u mean by this. When you trying to new thing on fresh windows XP, and if u received an error related "To unblock a publisher" then you should do to following instructions.

To unblock a publisher

Why is this publisher blocked?

Someone who uses or manages this computer specifically chose to block this publisher. To open or run this file, you will need to unblock the publisher. You should only try to open this file if you trust the publisher and you are sure the file is safe.

Open Internet Explorer.
On the Tools menu, click Internet Options.
On the Content tab, click Publishers.
On the Untrusted Publishers tab, click the publisher you want to unblock, and click Remove.

Blocking a publisher is not the same as blocking or restricting a Web site. Blocking a publisher does not restrict you from going to a Web site that distributes files from that publisher, but you will not be able to open those files unless you unblock the publisher first. Any publisher you block will be blocked on all Web sites, not just the Web site you were on when you blocked it.

Read More