D-Link DFL-1660 User Manual page 309

7.3.7. SAT and FwdFast Rules
• Return traffic from wwwsrv:80 will match rules 2 and 3. The replies will therefore be
dynamically address translated. This changes the source port to a completely different port,
which will not work.
The problem can be solved using the following rule set:
# Action
1 SAT
2 SAT
3 FwdFast
4 NAT
5 FwdFast
• External traffic to wan_ip:80 will match rules 1 and 5 and will be sent to wwwsrv.
• Return traffic from wwwsrv:80 will match rules 2 and 3.
• Internal traffic to wan_ip:80 will match rules 1 and 4, and will be sent to wwwsrv. The sender
address will be the NetDefend Firewall's internal IP address, guaranteeing that return traffic
passes through the NetDefend Firewall.
• Return traffic will automatically be handled by the NetDefend Firewall's stateful inspection
mechanism.
Src Iface Src Net Dest Iface
any all-nets core
lan wwwsrv any
lan wwwsrv any
lan lannet any
lan wwwsrv any
Dest Net
wan_ip
all-nets
all-nets
all-nets
all-nets
309
Chapter 7. Address Translation
Parameters
http SETDEST wwwsrv 80
80 -> All SETSRC wan_ip 80
80 -> All
All
80 -> All