{"id":31629,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/8-check-point-getting-started-r80-20-nat\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"8-check-point-getting-started-r80-20-nat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","title":{"rendered":"8. Check Point Za\u010diatky R80.20. NAT","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"8.
\n
\nVitajte na \u00f4smej lekcii. T\u00e1to lekcia je ve\u013emi d\u00f4le\u017eit\u00e1, preto\u017ee po jej dokon\u010den\u00ed u\u017e budete schopn\u00ed nastavi\u0165 pripojenie k internetu pre va\u0161ich pou\u017e\u00edvate\u013eov! Treba uzna\u0165, \u017ee mnoh\u00ed s t\u00fdmto nastaven\u00edm kon\u010dia \ud83d\ude42 Ale my nie sme ich s\u00fa\u010das\u0165ou! A pred nami je e\u0161te ve\u013ea zauj\u00edmav\u00e9ho. Teraz sa teda pust\u00edme do t\u00e9my na\u0161ej lekcie.<\/p>\n

Ako ste u\u017e pravdepodobne uh\u00e1dli, dnes sa budeme rozpr\u00e1va\u0165 o NAT. Som si ist\u00fd, \u017ee v\u0161etci, ktor\u00ed sleduj\u00fa t\u00fato lekciu, vedia, \u010do NAT znamen\u00e1. Preto sa nebudeme podrobne zaobera\u0165 t\u00fdm, ako to funguje. E\u0161te raz zopakujem, \u017ee NAT je technol\u00f3gia prekladu adries, ktor\u00e1 bola vymyslen\u00e1 s cie\u013eom \u0161etri\u0165 \u201ebiele\u201c, teda verejn\u00e9 IP adresy (tie adresy, ktor\u00e9 s\u00fa smerovan\u00e9 v sieti Internet). <\/p>\n

Vo predch\u00e1dzaj\u00facej lekcii ste si pravdepodobne u\u017e v\u0161imli, \u017ee NAT je s\u00fa\u010das\u0165ou politiky Access Control. To je celkom logick\u00e9. V SmartConsole s\u00fa nastavenia NAT presunut\u00e9 do samostatnej z\u00e1lo\u017eky. Dnes sa tam ur\u010dite pozrieme. Vo v\u0161eobecnosti v tejto lekcii prediskutujeme typy NAT, nastav\u00edme pripojenie k internetu a presk\u00famame klasick\u00fd pr\u00edklad s port forwardingom. Teda ten funk\u010dn\u00fd prvok, ktor\u00fd sa naj\u010dastej\u0161ie pou\u017e\u00edva vo firm\u00e1ch. Po\u010fme na to.
\n<\/a><\/noindex><\/p>\n

Dva sp\u00f4soby nastavenia NAT<\/h3>\n

\nCheck Point podporuje dva sp\u00f4soby nastavenia NAT: Automatick\u00fd NAT<\/b> a Manu\u00e1lny NAT<\/b>. Pre ka\u017ed\u00fd z t\u00fdchto sp\u00f4sobov existuj\u00fa dva typy prekladu: Hide NAT<\/b> a Statick\u00fd NAT<\/b>. V celkovom poh\u013eade to vyzer\u00e1 ako na tomto obr\u00e1zku:<\/p>\n

\"8.
\n
\nCh\u00e1pem, \u017ee to teraz m\u00f4\u017ee vyzera\u0165 zlo\u017eit\u011b, tak si ka\u017ed\u00fd typ podrobnej\u0161ie presk\u00famame.<\/p>\n

Automatick\u00fd NAT<\/h3>\n

\nToto je najr\u00fdchlej\u0161\u00ed a najjednoduch\u0161\u00ed sp\u00f4sob. Nastavenie NAT sa d\u00e1 spravi\u0165 doslova v dvoch kliknutiach. V\u0161etko, \u010do mus\u00edte urobi\u0165, je otvori\u0165 vlastnosti po\u017eadovan\u00e9ho objektu (\u010di u\u017e to je br\u00e1na, sie\u0165, hostite\u013e at\u010f.), prejs\u0165 na z\u00e1lo\u017eku NAT a za\u0161krtn\u00fa\u0165 \u201ePrida\u0165 automatick\u00e9 pravidl\u00e1 pre preklad adries<\/b>\u201c. Tu presne uvid\u00edte pole \u2013 met\u00f3da prekladu. T\u00fdch, ako u\u017e bolo povedan\u00e9 vy\u0161\u0161ie, s\u00fa dve.<\/p>\n

\"8.
\n<\/p>\n

1. Automatick\u00fd Hide NAT<\/h4>\n

\nPredvolene je to Hide. Teda v tomto pr\u00edpade sa na\u0161a sie\u0165 bude \u201eskry\u0165\u201c za nejakou verejnou IP adresou. Pri\u010dom adresu mo\u017eno z\u00edska\u0165 z vonkaj\u0161ieho rozhrania br\u00e1ny, alebo m\u00f4\u017eete zada\u0165 nejak\u00fa in\u00fa. Tento typ NAT-u sa \u010dasto naz\u00fdva dynamick\u00fd alebo many-to-one<\/b>, preto\u017ee nieko\u013eko intern\u00fdch adries sa preklad\u00e1 na jednu vonkaj\u0161iu. Samozrejme, to je mo\u017en\u00e9 v\u010faka pou\u017eitiu r\u00f4znych portov pri preklade. Hide NAT funguje len jedn\u00fdm smerom (zdola nahor) a ide\u00e1lne sa hod\u00ed pre lok\u00e1lne siete, ke\u010f je potrebn\u00e9 jednoducho zabezpe\u010di\u0165 pr\u00edstup na internet. Ak bude prev\u00e1dzka iniciovan\u00e1 z vonkaj\u0161ej siete, NAT samozrejme nebude fungova\u0165. Vznik\u00e1 tak akoby \u010fal\u0161ia ochrana intern\u00fdch siet\u00ed.<\/p>\n

2. Automatick\u00fd statick\u00fd NAT<\/h4>\n

\nHide NAT je skvel\u00fd, ale mo\u017eno potrebujete zabezpe\u010di\u0165 pr\u00edstup z vonkaj\u0161ej siete k nejak\u00e9mu intern\u00e9mu serveru. Napr\u00edklad k DMZ-serveru, ako je v na\u0161om pr\u00edpade. V tomto pr\u00edpade n\u00e1m m\u00f4\u017ee pom\u00f4c\u0165 statick\u00fd NAT. Jeho nastavenie je tie\u017e pomerne jednoduch\u00e9. Sta\u010d\u00ed v nastaveniach objektu zmeni\u0165 met\u00f3du prekladu na Static a uvies\u0165 verejn\u00fa IP adresu, ktor\u00e1 sa bude pou\u017e\u00edva\u0165 pre NAT (pozri obr\u00e1zok vy\u0161\u0161ie). T.j. ak sa niekto z vonkaj\u0161ej siete pripoj\u00ed na t\u00fato adresu (cez ak\u00fdko\u013evek port!), po\u017eiadavka bude preposlan\u00e1 na server s u\u017e internou IP adresou. Ak sa pritom server pripoj\u00ed na internet, tak jeho IP adresa sa tie\u017e zmen\u00ed na uveden\u00fa adresu. T.j. ide o NAT v oboch smeroch. Niekedy sa to naz\u00fdva one-to-one<\/b> a ob\u010das sa pou\u017e\u00edva pre verejn\u00e9 servery. Pre\u010do 'ob\u010das'? Preto\u017ee m\u00e1 jednu ve\u013ek\u00fa nev\u00fdhodu - verejn\u00e1 IP adresa je \u00faplne obsaden\u00e1 (v\u0161etky porty). Nie je mo\u017en\u00e9 pou\u017ei\u0165 jednu verejn\u00fa adresu pre r\u00f4zne intern\u00e9 servery (s r\u00f4znymi portami). Napr\u00edklad HTTP, FTP, SSH, SMTP a tak \u010falej. Tento probl\u00e9m m\u00f4\u017ee vyrie\u0161i\u0165 manu\u00e1lny NAT.<\/p>\n

Manu\u00e1lny NAT<\/h3>\n

\n\u0160pecifikou manu\u00e1lneho NAT je, \u017ee je potrebn\u00e9 samostatne vytv\u00e1ra\u0165 pravidl\u00e1 pre preklad. V tej istej karte NAT v politik\u00e1ch kontroly pr\u00edstupu. Manu\u00e1lny NAT umo\u017e\u0148uje vytv\u00e1ra\u0165 zlo\u017eitej\u0161ie pravidl\u00e1 pre preklad. M\u00f4\u017eete vyu\u017ei\u0165 tak\u00e9 polia ako: P\u00f4vodn\u00fd zdroj, P\u00f4vodn\u00e1 destin\u00e1cia, P\u00f4vodn\u00e9 slu\u017eby, Prelo\u017een\u00fd zdroj, Prelo\u017een\u00e1 destin\u00e1cia, Prelo\u017een\u00e9 slu\u017eby. <\/p>\n

\"8.
\n
\nTu s\u00fa tie\u017e mo\u017en\u00e9 dva typy NAT - Hide a Static.<\/p>\n

1. Manu\u00e1lny Hide NAT<\/h4>\n

\nHide NAT sa v tomto pr\u00edpade m\u00f4\u017ee pou\u017e\u00edva\u0165 v r\u00f4znych situ\u00e1ci\u00e1ch. Nieko\u013eko pr\u00edkladov:<\/p>\n

    \n
  1. Pri pr\u00edstupe k nejak\u00e9mu konkr\u00e9tnemu zdroju z lok\u00e1lnej siete chcete pou\u017ei\u0165 in\u00fa adresu na preklad (odli\u0161n\u00fa od tej, ktor\u00e1 sa pou\u017e\u00edva vo v\u0161etk\u00fdch ostatn\u00fdch pr\u00edpadoch).<\/li>\n
  2. V lok\u00e1lnej sieti je obrovsk\u00e9 mno\u017estvo po\u010d\u00edta\u010dov. Automatic Hide NAT tu nie je vhodn\u00fd, preto\u017ee pri takomto nastaven\u00ed je mo\u017en\u00e9 nastavi\u0165 iba jednu verejn\u00fa IP adresu, za ktorou sa bud\u00fa \"schov\u00e1va\u0165\" po\u010d\u00edta\u010de. Portov na prekl\u00e1dku m\u00f4\u017ee jednoducho by\u0165 nedostatok. T\u00fdch, ako si pam\u00e4t\u00e1te, je nie\u010do m\u00e1lo viac ako 65 tis\u00edc. Z\u00e1rove\u0148 ka\u017ed\u00fd po\u010d\u00edta\u010d m\u00f4\u017ee generova\u0165 stovky rel\u00e1ci\u00ed. Manual Hide NAT umo\u017e\u0148uje v poli Translated Source nastavi\u0165 skupinu verejn\u00fdch ip-adresy<\/a>. T\u00fdmto sa zv\u00fd\u0161i po\u010det mo\u017en\u00fdch NAT-transl\u00e1ci\u00ed.<\/li>\n<\/ol>\n

    <\/p>\n

    2. Manual Static NAT<\/h4>\n

    \nStatic NAT sa pou\u017e\u00edva ove\u013ea \u010dastej\u0161ie pri ru\u010dnom vytv\u00e1ran\u00ed pravidiel prekl\u00e1dky. Klasick\u00fdm pr\u00edkladom je preposielanie portov. Pr\u00edpad, ke\u010f sa z vonkaj\u0161ej siete obr\u00e1ti na verejn\u00fa IP adresu (ktor\u00e1 m\u00f4\u017ee patri\u0165 br\u00e1ne) cez ur\u010dit\u00fd port a po\u017eiadavka sa preklad\u00e1 na vn\u00fatorn\u00fd zdroj. V na\u0161ej laborat\u00f3rnej pr\u00e1ci preposunieme port 80 na DMZ server.<\/p>\n

    Video lekcia<\/h3>\n

    \n

    \r\n \"Prehrajte\r\n
    <\/div>\r\n <\/div><\/center>
    \nSledujte n\u00e1s na\u010falej a pridajte sa k na\u0161ej     YouTube channel<\/a><\/noindex> \ud83d\ude42
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 8-\u0439 \u0443\u0440\u043e\u043a. \u0423\u0440\u043e\u043a \u043e\u0447\u0435\u043d\u044c \u0432\u0430\u0436\u043d\u044b\u0439, \u0442.\u043a. \u043f\u043e \u0435\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0432\u044b \u0443\u0436\u0435 \u0441\u043c\u043e\u0436\u0435\u0442\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0432\u044b\u0445\u043e\u0434 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0434\u043b\u044f \u0432\u0430\u0448\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439! \u041d\u0430\u0434\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430 \u044d\u0442\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u0438 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u044e\u0442 \ud83d\ude42 \u041d\u043e \u043c\u044b \u043d\u0435 \u0438\u0437 \u0438\u0445 \u0447\u0438\u0441\u043b\u0430! \u0418 \u0443 \u043d\u0430\u0441 \u0435\u0449\u0435 \u043c\u043d\u043e\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u0432\u043f\u0435\u0440\u0435\u0434\u0438. \u0410 \u0442\u0435\u043f\u0435\u0440\u044c \u043a \u0442\u0435\u043c\u0435 \u043d\u0430\u0448\u0435\u0433\u043e \u0443\u0440\u043e\u043a\u0430. \u041a\u0430\u043a \u0432\u044b \u0443\u0436\u0435 \u043d\u0430\u0432\u0435\u0440\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23547,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd478. Check Point Getting Started R80.20. NAT | ProHoster","description":"Vitajte na 8. lekcii.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd478. Check Point Getting Started R80.20. NAT | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 8-\u0439 \u0443\u0440\u043e\u043a.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/8-check-point-getting-started-r80-20-nat","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31629","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:40:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-02-08 20:40:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31629"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31629\/revisions"}],"predecessor-version":[{"id":157992,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31629\/revisions\/157992"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23547"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}