Re: [FW1] what occurs first NAT or RULEBASE

[Paul Cardon <paul@FW1-NOSPAMmoquijo.com>]

Frank Knobbe wrote:
> 
> > -----Original Message-----
> > From: erik.lokken@eterra.no [mailto:erik.lokken@eterra.no]
> > Sent: Tuesday, June 26, 2001 5:29 PM
> >
> > 1.    HIDE
> >       Client initialize comm. --> Inspected by Firewall (both
> > Inbound and
> > Outbound) --> Packet get's translated (Source Hidden) -->
> > Leaves Gateway .
> > (NAT LAST THING THAT HAPPENS)
> >
> > 2.    Static Destination
> >       Client initialize comm. --> Inspected by Firewall (both
> > Inbound and
> > Outbound) --> Packet get's translated (Destination address is
> > translated)
> > --> Leaves Gateway . (NAT LAST THING THAT HAPPENS)
> >
> > 3.    Static Source
> >       Client initialize comm. --> Inspected by Firewall (both
> > Inbound and
> > Outbound) --> Packet get's translated (Source Address is
> > translated) -->
> > Leaves Gateway . (NAT LAST THING THAT HAPPENS)
> 
> Just to emphasize: In case 1 and case 3, 'client' means a computer
> within the protected network, behind the firewall.
> In case 2, 'client' means a computer in the unprotected network, in
> front of the firewall (such as a visitor hitting a web site [that is
> behind the firewall]).

These definitions are true in the majority of cases, and I realize that
you are trying to clarify, but there are configurations where the
'client' is not oriented the way you describe with respect to the NAT. 
Erik's descriptions are correct for ALL configurations.  

Why you would need such a backwards configuration is left as an exercise
to the reader.  If you've never encountered them in production
environments, consider yourself fortunate.  They're usually put in place
temporarily because something else is broken or poorly designed and will
take some time to fix.  8^O

-paul


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================