NAT¶
The NAT tab of Security policy holds the device's address translation rules: outbound masquerading, so internal networks reach the internet, and port forwards, so the internet reaches an internal host.
The NAT table¶
Each rule is shown with its Kind, its Original traffic and its Translated traffic, so you can read what it does without reading pf syntax. Kinds are Masquerade, Port-fwd, 1:1 and Custom.
Rules are grouped as Generated automatically (created by an integration) and Rules (yours). In Simple view the generated ones are summarised into one line.
Two tags flag rules that cannot do what they look like:
- matches nothing — Translates {subnet}, which is not a network on this device and is not routed by it. Usually left behind by a deleted or renumbered interface.
- duplicate — Repeats "{other}", which matches the same traffic.
Adding a rule¶
Add NAT offers:
| Choice | Use for |
|---|---|
| Masquerade (outbound) | Hide an internal network behind the gateway's public address. See Outbound NAT. |
| Port forward (inbound) | Forward an external port to an internal host. See Port forwarding. |
| Advanced | Full control: filters, translation, pools and methods |
Advanced has Original traffic (match) (incoming and outgoing interface, protocol, source, destination), Translate source (SNAT / masquerade) with Translated address, Distribution and Sticky address, Bidirectional 1:1 (binat), and Translate destination (port forward). When you edit a rule that no longer fits a simple form, the form offers Switch to advanced… rather than dropping detail.
Each rule also takes a Name, e.g. HTTPS to web server. Show pf rule on a row shows the line it becomes.