{"id":31629,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/8-check-point-getting-started-r80-20-nat\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"8-check-point-getting-started-r80-20-nat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","title":{"rendered":"8. Check Point Za\u010d\u00edn\u00e1me R80.20. NAT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"8.
\n
\nV\u00edtejte v 8. lekci. Tato lekce je velmi d\u016fle\u017eit\u00e1, proto\u017ee po jej\u00edm dokon\u010den\u00ed budete schopni nastavit p\u0159ipojen\u00ed k internetu pro va\u0161e u\u017eivatele! Je t\u0159eba p\u0159iznat, \u017ee mnoho lid\u00ed t\u00edmto nastaven\u00edm kon\u010d\u00ed \ud83d\ude42 Ale my mezi n\u011b nepat\u0159\u00edme! A m\u00e1me p\u0159ed sebou je\u0161t\u011b spoustu zaj\u00edmav\u00e9ho. Nyn\u00ed se dost\u00e1v\u00e1me k t\u00e9matu na\u0161\u00ed lekce.<\/p>\n

Jak jste si asi ji\u017e domysleli, dnes budeme hovo\u0159it o NAT. Jsem si jist\u00fd, \u017ee v\u0161ichni, kdo sleduj\u00ed tuto lekci, v\u011bd\u00ed, co je to NAT. Proto nebudeme podrobn\u011b popisovat, jak to funguje. Jen je\u0161t\u011b jednou zopakuji, \u017ee NAT je technologie p\u0159ekladu adres, kter\u00e1 byla vym\u00fd\u0161lena za \u00fa\u010delem \u00faspory \u201eb\u00edl\u00fdch\u201c, tzn. ve\u0159ejn\u00fdch IP adres (t\u011bch adres, kter\u00e9 jsou sm\u011brov\u00e1ny v s\u00edti Internet). <\/p>\n

V p\u0159edchoz\u00ed lekci jste si pravd\u011bpodobn\u011b v\u0161imli, \u017ee NAT je sou\u010d\u00e1st\u00ed politiky \u0159\u00edzen\u00ed p\u0159\u00edstupu. To d\u00e1v\u00e1 smysl. V SmartConsole jsou nastaven\u00ed NAT vy\u010dlen\u011bna do samostatn\u00e9 z\u00e1lo\u017eky. Dnes se na ni ur\u010dit\u011b pod\u00edv\u00e1me. V celkov\u00e9m pohledu v t\u00e9to lekci probereme typy NAT, nastav\u00edme p\u0159\u00edstup na Internet a prozkoum\u00e1me klasick\u00fd p\u0159\u00edklad s p\u0159esm\u011brov\u00e1n\u00edm port\u016f. Tzn. funk\u010dnost, kter\u00e1 se nej\u010dast\u011bji pou\u017e\u00edv\u00e1 ve firm\u00e1ch. Poj\u010fme na to.
\n<\/a><\/noindex><\/p>\n

Dva zp\u016fsoby nastaven\u00ed NAT<\/h3>\n

\nCheck Point podporuje dva zp\u016fsoby nastaven\u00ed NAT: Automatick\u00fd NAT<\/b> a Manu\u00e1ln\u00ed NAT<\/b>. Pro ka\u017ed\u00fd z t\u011bchto zp\u016fsob\u016f existuj\u00ed dva typy p\u0159ekladu: Hide NAT<\/b> a Statick\u00fd NAT<\/b>. V obecn\u00e9 podob\u011b to vypad\u00e1 jako na tomto obr\u00e1zku:<\/p>\n

\"8.
\n
\nRozum\u00edm, \u017ee to nyn\u00ed pravd\u011bpodobn\u011b vypad\u00e1 velmi slo\u017eit\u011b, proto si probereme ka\u017ed\u00fd typ podrobn\u011bji.<\/p>\n

Automatick\u00fd NAT<\/h3>\n

\nTo je nejrychlej\u0161\u00ed a nejjednodu\u0161\u0161\u00ed zp\u016fsob. Nastaven\u00ed NAT se prov\u00e1d\u00ed doslova ve dvou kliknut\u00edch. V\u0161e, co mus\u00edte ud\u011blat, je otev\u0159\u00edt vlastnosti po\u017eadovan\u00e9ho objektu (a\u0165 u\u017e je to br\u00e1na, s\u00ed\u0165, host atd.), p\u0159ej\u00edt na z\u00e1lo\u017eku NAT a za\u0161krtnout pol\u00ed\u010dko \u201eP\u0159idat automatick\u00e1 pravidla pro p\u0159eklad adres<\/b>\u201c. Zde tak\u00e9 uvid\u00edte pole \u2014 metodu p\u0159ekladu. Jak ji\u017e bylo uvedeno v\u00fd\u0161e \u2014 jsou dv\u011b.<\/p>\n

\"8.
\n<\/p>\n

1. Automatick\u00fd Hide NAT<\/h4>\n

\nVe v\u00fdchoz\u00edm nastaven\u00ed je to Hide. Tzn. v tomto p\u0159\u00edpad\u011b se na\u0161e s\u00ed\u0165 \u201eschov\u00e1\u201c za n\u011bjakou ve\u0159ejnou IP adresou. Tato adresa m\u016f\u017ee b\u00fdt vzata z extern\u00edho rozhran\u00ed br\u00e1ny nebo lze uv\u00e9st n\u011bjakou jinou. Tento typ NAT se \u010dasto naz\u00fdv\u00e1 dynamick\u00fdm nebo many-to-one<\/b>, proto\u017ee n\u011bkolik vnit\u0159n\u00edch adres se p\u0159ev\u00e1d\u00ed na jednu extern\u00ed. To je samoz\u0159ejm\u011b mo\u017en\u00e9 d\u00edky pou\u017eit\u00ed r\u016fzn\u00fdch port\u016f p\u0159i p\u0159ekladu. Hide NAT funguje pouze jedn\u00edm sm\u011brem (zvnit\u0159ku ven) a ide\u00e1ln\u011b se hod\u00ed pro m\u00edstn\u00ed s\u00edt\u011b, kde je t\u0159eba pouze zajistit p\u0159\u00edstup k internetu. Pokud bude provoz iniciov\u00e1n z extern\u00ed s\u00edt\u011b, NAT p\u0159irozen\u011b nebude fungovat. Vznik\u00e1 tedy jak\u00e1si dodate\u010dn\u00e1 ochrana vnit\u0159n\u00edch s\u00edt\u00ed.<\/p>\n

2. Automatick\u00fd statick\u00fd NAT<\/h4>\n

\nHide NAT je skv\u011bl\u00fd, ale mo\u017en\u00e1 pot\u0159ebujete zajistit p\u0159\u00edstup z extern\u00ed s\u00edt\u011b k n\u011bjak\u00e9mu vnit\u0159n\u00edmu serveru. Nap\u0159\u00edklad k DMZ serveru, jak je uk\u00e1z\u00e1no v na\u0161em p\u0159\u00edkladu. V takov\u00e9m p\u0159\u00edpad\u011b n\u00e1m m\u016f\u017ee pomoci Static NAT. Nastavuje se tak\u00e9 docela jednodu\u0161e. Sta\u010d\u00ed v vlastnostech objektu zm\u011bnit metodu p\u0159ekladu na Static a uv\u00e9st ve\u0159ejnou IP adresu, kter\u00e1 bude pou\u017e\u00edv\u00e1na pro NAT (viz obr\u00e1zek v\u00fd\u0161e). Tedy pokud se n\u011bkdo z extern\u00ed s\u00edt\u011b obr\u00e1t\u00ed na tuto adresu (p\u0159es libovoln\u00fd port!), \u017e\u00e1dost bude p\u0159ed\u00e1na serveru s ji\u017e vnit\u0159n\u00ed IP adresou. Pokud server s\u00e1m vyjde na internet, jeho IP adresa se tak\u00e9 zm\u011bn\u00ed na uvedenou adresu. Tedy se jedn\u00e1 o NAT ob\u011bma sm\u011bry. \u0158\u00edk\u00e1 se mu tak\u00e9 one-to-one<\/b> a n\u011bkdy se pou\u017e\u00edv\u00e1 pro ve\u0159ejn\u00e9 servery. Pro\u010d \"n\u011bkdy\"? Proto\u017ee m\u00e1 jednu velkou nev\u00fdhodu \u2014 ve\u0159ejn\u00e1 IP adresa je pln\u011b obsazena (v\u0161echny porty). Nelze pou\u017e\u00edvat jednu ve\u0159ejnou adresu pro r\u016fzn\u00e9 vnit\u0159n\u00ed servery (s r\u016fzn\u00fdmi porty). Nap\u0159\u00edklad HTTP, FTP, SSH, SMTP atd. \u0158e\u0161en\u00edm tohoto probl\u00e9mu m\u016f\u017ee b\u00fdt Manual NAT.<\/p>\n

Manu\u00e1ln\u00ed NAT<\/h3>\n

\nCharakteristika Manual NAT spo\u010d\u00edv\u00e1 v tom, \u017ee je t\u0159eba jednotliv\u011b vytv\u00e1\u0159et pravidla p\u0159ekladu. P\u0159\u00edmo v z\u00e1lo\u017ece NAT v p\u0159\u00edstupov\u00e9 politice. Manual NAT umo\u017e\u0148uje vytv\u00e1\u0159et slo\u017eit\u011bj\u0161\u00ed pravidla p\u0159ekladu. Jsou v\u00e1m k dispozici takov\u00e1 pole jako: P\u016fvodn\u00ed zdroj, P\u016fvodn\u00ed c\u00edl, P\u016fvodn\u00ed slu\u017eby, P\u0159elo\u017een\u00fd zdroj, P\u0159elo\u017een\u00fd c\u00edl, P\u0159elo\u017een\u00e9 slu\u017eby. <\/p>\n

\"8.
\n
\nZde jsou tak\u00e9 mo\u017en\u00e9 dva typy NAT \u2014 Hide a Static.<\/p>\n

1. Ru\u010dn\u00ed Hide NAT<\/h4>\n

\nHide NAT m\u016f\u017ee b\u00fdt v tomto p\u0159\u00edpad\u011b pou\u017eito v r\u016fzn\u00fdch situac\u00edch. P\u00e1r p\u0159\u00edklad\u016f:<\/p>\n

    \n
  1. P\u0159i p\u0159\u00edstupu k n\u011bjak\u00e9mu konkr\u00e9tn\u00edmu zdroji z m\u00edstn\u00ed s\u00edt\u011b chcete pou\u017e\u00edvat jinou adresu pro p\u0159eklad (r\u016fznou od t\u00e9, kter\u00e1 se pou\u017e\u00edv\u00e1 pro v\u0161echny ostatn\u00ed p\u0159\u00edpady).<\/li>\n
  2. V lok\u00e1ln\u00ed s\u00edti je obrovsk\u00e9 mno\u017estv\u00ed po\u010d\u00edta\u010d\u016f. Automatic Hide NAT zde nebude vyhovovat, proto\u017ee p\u0159i tomto nastaven\u00ed je mo\u017en\u00e9 p\u0159i\u0159adit pouze jednu ve\u0159ejnou IP adresu, za kterou se budou \"skr\u00fdvat\" po\u010d\u00edta\u010de. Port\u016f pro p\u0159eklad m\u016f\u017ee jednodu\u0161e b\u00fdt nedostatek. Jak jist\u011b v\u00edte, jich je n\u011bco m\u00e1lo p\u0159es 65 tis\u00edc. Ka\u017ed\u00fd po\u010d\u00edta\u010d p\u0159itom m\u016f\u017ee generovat stovky relac\u00ed. Manual Hide NAT umo\u017e\u0148uje v poli Translated Source nastavit pool ve\u0159ejn\u00fdch IP adres<\/a>. T\u00edm se zvy\u0161uje po\u010det mo\u017en\u00fdch NAT p\u0159eklad\u016f.<\/li>\n<\/ol>\n

    <\/p>\n

    2. Manual Static NAT<\/h4>\n

    \nStatic NAT se pou\u017e\u00edv\u00e1 mnohem \u010dast\u011bji p\u0159i ru\u010dn\u00edm vytv\u00e1\u0159en\u00ed pravidel pro p\u0159eklad. Klasick\u00fdm p\u0159\u00edkladem je p\u0159epos\u00edl\u00e1n\u00ed port\u016f. P\u0159\u00edpad, kdy se z extern\u00ed s\u00edt\u011b dotazuj\u00ed na ve\u0159ejnou IP adresu (kter\u00e1 m\u016f\u017ee pat\u0159it br\u00e1n\u011b) na ur\u010dit\u00e9m portu a po\u017eadavek je p\u0159ekl\u00e1d\u00e1n na vnit\u0159n\u00ed zdroj. V na\u0161\u00ed laboratorn\u00ed pr\u00e1ci p\u0159epo\u0161leme port 80 na DMZ server.<\/p>\n

    Video lekce<\/h3>\n

    \n

    \r\n \"P\u0159ehr\u00e1t\r\n
    <\/div>\r\n <\/div><\/center>
    \nZ\u016fsta\u0148te nalad\u011bni na dal\u0161\u00ed a p\u0159ipojte se k na\u0161emu     YouTube kan\u00e1lu<\/a><\/noindex> \ud83d\ude42
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 8-\u0439 \u0443\u0440\u043e\u043a. \u0423\u0440\u043e\u043a \u043e\u0447\u0435\u043d\u044c \u0432\u0430\u0436\u043d\u044b\u0439, \u0442.\u043a. \u043f\u043e \u0435\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0432\u044b \u0443\u0436\u0435 \u0441\u043c\u043e\u0436\u0435\u0442\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0432\u044b\u0445\u043e\u0434 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439! \u041d\u0430\u0434\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430 \u044d\u0442\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u0438 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044e\u0442 \ud83d\ude42 \u041d\u043e \u043c\u044b \u043d\u0435 \u0438\u0437 \u0438\u0445 \u0447\u0438\u0441\u043b\u0430! \u0418 \u0443 \u043d\u0430\u0441 \u0435\u0449\u0435 \u043c\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u0432\u043f\u0435\u0440\u0435\u0434\u0438. \u0410 \u0442\u0435\u043f\u0435\u0440\u044c \u043a \u0442\u0435\u043c\u0435 \u043d\u0430\u0448\u0435\u0433\u043e \u0443\u0440\u043e\u043a\u0430. \u041a\u0430\u043a \u0432\u044b \u0443\u0436\u0435 \u043d\u0430\u0432\u0435\u0440\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23547,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd478. Check Point Getting Started R80.20. NAT | ProHoster","description":"V\u00edtejte na 8. lekci.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd478. Check Point Getting Started R80.20. NAT | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 8-\u0439 \u0443\u0440\u043e\u043a.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31629","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:40:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-02-08 20:40:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31629"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31629\/revisions"}],"predecessor-version":[{"id":157992,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31629\/revisions\/157992"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23547"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}