7.2.5. Network Mapping

Network mapping rules allow substitution of the source or destination network address. This is usually required when there are multiple networks with identical addressing, such as 192.168.1.0/24, that need to be merged into a single routed network. Without network address substitution, this kind of merge would be impossible. Network mapping changes only the network address, leaving the host address as is: for example, if source network 192.168.1.0/24 is substituted with 192.168.2.0/24, host 192.168.1.1 will change to 192.168.2.1.

Note

The rules are applied top to bottom in their listing order. Only the first rule in which all conditions are matched is applied. This means that more specific rules must be placed higher in the list than more general ones. To change the order in which the rules will be applied, use the Up/Down and Top/Bottom buttons or drag and drop the rules with the mouse.

To create a network mapping rule, go to the Network policies --> NAT and routing section, click Add, and provide the desired settings.

Name

Description

Enabled

Enables or disables the rule.

Name

The name of the rule.

Description

A description of the rule.

Type

Select Network mapping.

Logging

Logs traffic information when the rule is triggered. The available options are:

  • Log session start: only the session start (first packet) will be recorded in the traffic log. This is the recommended logging option.

  • None. Nothing will be logged.

Source

The zone, IP address lists, GeoIP address lists, or URL lists of the traffic source.

The URL list must include only domain names. Every 5 minutes UserGate resolves domain names into IP addresses and stores the result in the internal cache for the DNS record's time-to-live (TTL). When the TTL expires, UserGate automatically updates the IP address value.

Important! There is a limit on the number of GeoIPs that can be specified: the number cannot exceed 15.

Important! If MAC addresses specified, the Negate checkbox will not work.

Important! Traffic processing performed with the following statements:

  • applying logic OR if several IP lists and/or domain lists are specified;

  • applying logic AND if several GeoIP and lists of IPs and/or domains are specified.

Destination

The zone, IP address lists, GeoIP address lists, or URL lists of the traffic destination.

The URL list must include only domain names. Every 5 minutes UserGate resolves domain names into IP addresses and stores the result in the internal cache for the DNS record's time-to-live (TTL). When the TTL expires, UserGate automatically updates the IP address value.

Important! There is a limit on the number of GeoIPs that can be specified: the number cannot exceed 15.

Important! Traffic processing performed with the following statements:

  • applying logic OR if several IP lists and/or domain lists are specified;

  • applying logic AND if several GeoIP and lists of IPs and/or domains are specified.

Service

The service type, such as HTTP, HTTPS or other.

Network Mapping

Configure the network substitution settings.

Direction:

  • Input, replace destination network address: destination IP addresses in the traffic that matches the rule conditions will be substituted. The network address is substituted with the one specified in the New network/mask field.

  • Output, replace source network address: source IP addresses in the traffic that matches the rule conditions will be substituted. The network address is substituted with the one specified in the New network/mask field.

  • New network/mask: the network address that gets substituted for the original one.

Usage

The rule triggering statistics: the total number of triggers, the time of the first and last triggers.

To reset statistics, select rules in the list and click Reset hit counts.

History

The time when the rule was created and last modified, as well as the event log entries related to this rule: adding, updating the rule, changing the position of the rule in the list, etc.