machines with an internal address may be accessed at the corresponding external valid ip address.
to create this relationship between internal and external addresses, define internal and external address ranges of equal length. once you have defined that relationship, the machine with the first internal address is accessible at the first ip address in the external address range, the second machine at the second external ip address, and so on.
consider a lan for which the isp has assigned the ip addresses range from 209.19.28.16 to 209.19.28.31, with 209.19.28.16 used as the nat public address. the address range of 192.168.1.1 to 192.168.1.255 is used for the machines on the lan. typically, only machines that have been designated as public lan servers are accessible from the internet. however, with one-to-one nat, the machines with the internal ip addresses of 192.168.1.2 to 192.168.1.16 are accessible at the corresponding external ip address, as shown in table 4.
table 4 address correspondence in one-to-one nat
you cannot include the nat public ip address in a range.
click advanced, and then select the one-to-one nat tab.
a window similar to that in figure 51 is displayed.
figure 51 one-to-one nat window
1 enable one-to-one nat
click this check box to enable one-to-one nat.
2 private range begin
type the beginning ip address of the private address range being mapped in the private range begin box.
this is the ip address of the first machine being made accessible from the internet.
do not include the nat public ip address in any range.
1 public range begin
type the beginning ip address of the public address
range being mapped in the public range begin box.
this address is assigned by the isp.
2 range length
type the number of ip addresses for the range. the range length may not exceed the number of valid ip address. you can add up to 64 ranges. to map a single address, use a range length of 1.
click update. restart the internet firewall for changes to take effect.
one-to-one nat does not change the way the firewall functions work. access to machines on the lan from the internet is not allowed unless you have set up network access rules are set, or established authenticated user sessions.