Scenario: Mapping IP addresses using NAT

In this scenario, your company uses static network address translation (NAT) to map its private IP addresses to public addresses.

Situation

You own a company and you decide to start a private network. However, you have never registered or acquired permission to use public IP addresses. When you access the Internet, you find that your company's address range is registered to someone else, so you think your current setup is obsolete. You need to allow public users access to your Web server. What should you do?

This picture shows a network consisting of a system (192.12.3.1) connected to the Internet.

Solution

You can use static NAT. Static NAT assigns one original (private) address to one registered (public) address. Your system maps this registered address to your private address. The registered address enables your private address to communicate with the Internet. Essentially, it forms a bridge between the two networks. Communication can be initiated from either network.

By using static NAT, you can keep all of your current internal IP addresses and still access the Internet. You need to have one registered IP address for each private address that accesses the Internet. For example, if you have 12 users, you need 12 public IP addresses to map to your 12 private addresses.

In this example, the NAT address, 192.12.3.1, sits unusable, like a shell, waiting for information to come back. When the information returns, NAT maps the address back to the personal computer. When static NAT is active, any inbound traffic destined directly to the address 192.12.3.1 never gets to that interface because it only represents your internal address. The real private address 10.10.1.1 is the actual destination, even though (to the world outside the system) it appears that 192.12.3.1 is the required IP address.

Configuration

To configure the packet rules that are described in this scenario, use the Address Translation wizard in IBM® Navigator for i. The wizard requires the following information:
  • The private address that you want to map: 10.10.1.1
  • The public address to which you want to map the private address: 192.12.3.1
  • The name of the line over which the address mapping takes place: TRNLINE

To use the Address Translation wizard, follow these steps:

  1. In IBM Navigator for i, expand Network > IP Policies, and click Packet Rules.
  2. In the Packet Rules panel, click Actions and select Rules Editor.
  3. From the Welcome Packet Rules Configuration dialog, select Create a new packet rules file, and click OK.
  4. If the Getting Started dialog pops up, read the instructions and click OK.
  5. From the Wizards menu, select Address Translation, and follow the wizard's instructions to configure the map-address -translation packet rules.

The packet rules look like the following example.

How your packet rules look like

After you finish creating these rules, you need to verify them to ensure that they can be activated without errors.

Note: The token ring line that is defined above (LINE=TRNLINE) must be the line that 192.12.3.1 uses. This static NAT will not work if 10.10.1.1 uses the defined token ring line above. Whenever you use NAT, you should also enable IP forwarding.