Configuring NAT on Juniper J-series
In the past, i configured a lot of nifty things on Juniper M-series routers like BGP, OSPF and all sorts of routing stuff. Back to basics (NAT) would have to be a piece of cake 
.
But…
Configuring NAT on a J-series Juniper box is pretty well documented in the Juniper documentation. I mean.. VERY well documented in a way nobody seems to get the whole point about NAT’ting on the box.
The most straightforward NAT configuration is never being discussed anywhere in the documentation and that makes it pretty hard to get it to work. After some braincracks, i finally managed to get it to work in a way i want it.
The usual CPE setup applies here, so we have one single public IP address on the outside and an RFC1918 192.168.1.0/24 subnet on the inside interface. Our default gateway resides at 217.1.10.254. Our mailserver is at 192.168.1.254, doing only SMTP.
Please note that i’m not running JunOS enhanced services in this example. With ES it should be a little more straightforward and easier to configure, but i just wanted it to run on the plain vanilla JunOS 9.1
remco@router> configure
remco@router# set system host-name myrouter
remco@router# set system domain-name remcobressers.nl
remco@router# set root-authentication plain-text-password
Enter your password here for root access.
remco@router# set domain-search remcobressers.nl
remco@router# set time-zone Europe/Amsterdam
remco@router# set location country-code nl
remco@router# set system name-server 217.1.10.10 217.1.10.11
remco@router# set system login user remco uid 2000 class super-user authentication plain-text-password
Enter your user password to enter the CLI.
remco@router# set system services ssh
Alright. We’re all set. Now let’s configure the interfaces. Let’s say ge-0/0/0 is our outside WAN interface and ge-0/0/1 is the inside LAN interface.
remco@router# edit interfaces ge-0/0/0 [edit interfaces ge-0/0/0] remco@router# set description "WAN" remco@router# set unit 0 family inet address 217.1.10.1/24 remco@router# top [edit] remco@router# edit interfaces ge-0/0/1 [edit interfaces ge-0/0/1] remco@router# set description "LAN" remco@router# set unit 0 family inet address 192.168.1.1/24 remco@router# top [edit] remco@router# set routing-options static route 0.0.0.0/0 next-hop 217.1.10.1
Ok. Our basic setup is completed. Let’s configure NAT. We have an internal server at 192.168.1.254 which does SMTP, so we need to configure 2 things:
- NAT from LAN to the WAN (overload)
- NAT port forwarding from WAN to 192.168.1.254 SMTP on the LAN
Shouldn’t be to difficult.
remco@router# edit services service-set wan-service-set [edit services service-set wan-service-set] remco@router# set nat-rules nat-outgoing remco@router# set nat-rules nat-incoming remco@router# set interface-service service-interface sp-0/0/0.0 remco@router# up [edit services] remco@router# edit nat [edit services nat] remco@router# set pool nat-pool address-range low 217.1.10.1 high 217.1.10.1 remco@router# set pool nat-pool port automatic remco@router# edit rule nat-outgoing [edit services nat rule nat-outgoing] remco@router# set match-direction output remco@router# set term 1 then translated source-pool nat-pool remco@router# set term 1 then translated translation-type source dynamic remco@router# up [edit services nat] remco@router# edit rule nat-incoming [edit services nat rule nat-incoming] remco@router# set match-direction input remco@router# set term smtp from destination-address 217.1.10.1/32 remco@router# set term smtp from applications junos-smtp remco@router# set term smtp then translated destination-prefix 192.168.1.254/32 remco@router# set term smtp then translated translation-type destination static remco@router# set term other from destination-address 217.1.10.1/32 remco@router# set term other then no-translation
Alright. This looks like a little confusing. It all comes down to the following.
- Create a service-set named “wan-service-set”, which holds our nat rules “nat-outgoing” and “nat-incoming”. Services needs a virtual services interface. In this case, the default is sp-0/0/0.0.
- In the NAT configuration, we create a pool, which holds one single public IP address (217.1.10.1). The ports are dynamically assigned.
- Our outgoing NAT rule is used to translate our internal traffic to the Internet on the public address. Our source pool is the pool we just created.
- Our incoming NAT rule is used to translate incoming SMTP traffic to our internal SMTP server at 192.168.1.254.
- We use the application “helper” junos-smtp instead of creating our own application. The result is the same.
- Other incoming traffic won’t be translated (this is important to include).
We now need to configure the service-set “wan-service-set” to the interface we do the translation on, which is the outside interface ge-0/0/0.
remco@router# top [edit] remco@router# edit interfaces ge-0/0/0 unit 0 family inet [edit interfaces ge-0/0/0 unit 0 family inet] remco@router# set service input service-set wan-service-set remco@router# set service output service-set wan-service-set
Alright, that’s about it. You can commit the configuration now with the “commit” command.
Your configuration will now look like this :
remco@router# top
[edit]
remco@router# show
## Last changed: 2008-07-17 21:13:49 CEST
version 9.1R1.8;
system {
host-name myrouter;
domain-name remcobressers.nl;
domain-search remcobressers.nl;
time-zone Europe/Amsterdam;
location country-code nl;
root-authentication {
encrypted-password "**************"; ## SECRET-DATA
}
name-server {
217.1.10.10;
217.1.10.11;
}
login {
user remco {
uid 2000;
class super-user;
authentication {
encrypted-password "***********"; ## SECRET-DATA
}
}
}
services {
ssh {
}
}
}
interfaces {
ge-0/0/0 {
description "WAN";
unit 0 {
family inet {
service {
input {
service-set wan-service-set;
}
output {
service-set wan-service-set;
}
}
address 217.1.10.1/24;
}
}
}
sp-0/0/0 {
unit 0 {
family inet;
}
}
ge-0/0/1 {
description "LAN";
unit 0 {
family inet {
address 192.168.1.1/24;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop 217.1.10.254;
}
}
services {
service-set wan-service-set {
nat-rules nat-outgoing;
nat-rules nat-incoming;
interface-service {
service-interface sp-0/0/0.0;
}
}
nat {
pool nat-pool {
address-range low 217.1.10.1 high 217.1.10.1;
port automatic;
}
rule nat-outgoing {
match-direction output;
term 1 {
then {
translated {
source-pool nat-pool;
translation-type {
source dynamic;
}
}
}
}
}
rule nat-incoming {
match-direction input;
term smtp {
from {
destination-address {
217.1.10.1/32;
}
applications junos-smtp;
}
then {
translated {
destination-prefix 192.168.1.254/32;
translation-type {
destination static;
}
}
}
}
term other {
from {
destination-address {
217.1.10.1/32;
}
}
then {
no-translation;
}
}
}
}
}
