WatchGuard Firebox System 4.6 User Guide

CHAPTER 10Setting Up NetworkAddress TranslationNetwork address translation (NAT) hides internal network addresses from hosts onan external network. WatchGuard supports two types of NAT:• Outgoing dynamic NATHides network addresses from hosts on another network; works only on outgoingmessages.• Incoming static NATProvides port-to-host remapping of incoming IP packets destined for a publicaddress to a single internal address; works only on incoming messages.For more information on NAT, see the Network Security Handbook.What is dynamic NAT?Also known as IP masquerading or port address translation, dynamic NAT hidesnetwork addresses from hosts on another network. Hosts elsewhere only seeoutgoing packets from the Firebox itself. This feature protects the confidentiality andarchitecture of your network. Another benefit is that it enables you to conserve IPaddresses.WatchGuard implements two forms of outgoing dynamic NAT:• Simple NAT – Using host aliases or IP host and network IP addresses, theFirebox globally applies network address translation to every outgoing packet.• Service-based NAT – Configure each service individually for outgoing dynamicNAT.Machines making incoming requests over a VPN connection are allowed toaccess masqueraded hosts.User Guide 63