Skip to content

Outbound NAT

Outbound NAT (masquerading) rewrites the source of outgoing packets to the gateway's own address, so clients with private addresses can reach the internet.

Most outbound NAT is created for you

Creating a network with an integration writes its outbound NAT rule along with its address, DHCP server and firewall rules. Those rules are listed under Generated automatically on the NAT tab.

Generated rules match on egress, pf's name for whichever interface holds the default route, and translate to the address of that interface. They keep working when the uplink's DHCP address changes and when traffic fails over to a backup uplink.

Adding one by hand

  1. Open Security policy and switch to the NAT tab.
  2. Click Add NAT → Masquerade (outbound).
  3. Fill in:
    • Outgoing interface — the uplink. It defaults to the interface described as WAN.
    • Source Network — the internal network, e.g. 192.168.1.0/24, or a network object
    • Name
  4. Click Create, then Apply Changes and Confirm.

The translated address is {iface} address: it follows the interface's address rather than a fixed one.

A rule on a named port does not follow a failover

A masquerade that matches on a named interface stops translating once traffic leaves by the backup uplink. Packets then go out with their private source address and nothing answers: the gateway itself stays online while everything behind it stops. If a network works on the main uplink and not on the backup, check this rule first.

On the device, pfctl -sr | grep nat-to should read match out on egress ... nat-to (egress).

Use one rule per source network. A second rule for the same network leaves the choice to rule order; the table tags it duplicate.

A network with no outbound rule

The device list marks a device that serves DHCP on a network no enabled outbound rule translates: network without internet, naming the network. Clients there get an address, reach the gateway, and nothing beyond.

The marker is read from the stored configuration, so it shows even when the device is offline or nothing is plugged into that port. A rule that is switched off counts as no rule.