WSM User Guide - WatchGuard Technologies

CHAPTER 9Working with Firewall NATNetwork Address Translation (NAT) was first developed as a solution for organizations that could not getenough registered IP network numbers from Internet Address Registrars for their increasing populationof hosts and networks.NAT is generically used to describe any of several forms of IP address and port translation. At its mostbasic level, NAT changes the IP address of a packet from one value to a different value. The primary purposesof NAT are to increase the number of computers that can operate off a single publicly routable IPaddress, and to hide the private IP addresses of hosts on your LAN.There are different ways to use NAT. WatchGuard® System Manager supports three different forms ofNAT.Dynamic NATDynamic NAT is also known as IP masquerading. The Firebox® can apply its public IP address tothe outgoing packets for all connections or for specified services. This hides the real IP addressof the computer that is the source of the packet from the external network. Dynamic NAT isgenerally used to hide the IP addresses of internal hosts when they get access to publicservices.1-to-1 NAT1-to-1 NAT binds hosts behind your optional or trusted networks to external IP addresses. Thistype of NAT is used to give external computers access to your public, internal servers.Static NAT for a policyAlso known as port forwarding, you configure static NAT when you configure policies, asdescribed in “Configuring Policy Properties” on page 150. Static NAT is a port-to-host NAT. Ahost sends a packet from the external network to a port on an external interface. Static NATchanges this IP address to an IP address and port behind the firewall.It is possible that, in your configuration, you use more than one type of NAT. You can apply NAT as a generalfirewall setting, or as a setting in a policy. Note that firewall NAT settings do not apply to BOVPN orMUVPN policies.User Guide 113