NAT on Real Firewalls: SNAT, DNAT, and VIPs

NAT is a critical feature for managing network traffic, especially when dealing with public and private IP addresses. In home routers, NAT is often handled as a single checkbox. However, real firewalls like FortiGate or OPNsense break down this functionality into more granular components: Source Network Address Translation (SNAT), Destination Network Address Translation (DNAT), and Virtual IPs (VIPs). These configurations allow for more flexible and secure network management.

SNAT: Source Network Address Translation

Source NAT (SNAT) rewrites the source address of outbound traffic. In a home router, this is often referred to as "masquerade" or "overload." Here’s how it works:

• Home Version: All internal devices share the same public IP address for outbound traffic, with port numbers used to track connections.
• Enterprise Version: You can configure different internal groups to exit through specific public IPs using IP pools. Additionally, you can set up 1:1 mappings where a single public IP is mapped directly to an internal IP.

FortiGate Example

In FortiGate, SNAT is managed via the outgoing policy and IP pools:

• Outgoing Policy: Enable NAT in the outgoing policy.
• IP Pools: Define IP pools for different internal groups.

DNAT: Destination Network Address Translation

Destination NAT (DNAT) rewrites the destination address of inbound traffic. This feature maps a public IP and port to an internal server. In home routers, this is commonly known as "port forwarding."

Home Version

• Port Forwarding: Map specific ports on the public IP to an internal device's private IP.

FortiGate Example

In FortiGate, DNAT is managed using VIP (Virtual IP) objects:

• VIP Object: Create a VIP mapping like wan-ip:443 → 192.168.10.5:443.
• Policy: Write a policy to allow traffic to the VIP.

1:1 NAT / Static NAT

1:1 NAT, also known as static NAT, maps a full public IP address to a full internal IP address for both directions (both incoming and outgoing).

Use Case

This is useful when a server needs to be accessible via its public IP address.

Configuration Examples

• FortiGate: Create a VIP object with all ports mapped.
• OPNsense: Use the 1:1 tab to set up static NAT mappings.

Hairpin/NAT Reflection/Loopback

Hairpin NAT, also known as loopback or NAT reflection, is necessary when internal clients try to access an internal server using its public IP address. Without it, the firewall translates the destination but the server replies straight to the client across the LAN, so the client gets an answer from an address it never contacted and drops it.

Fixing Hairpin Issues

• FortiGate: there is no reflection checkbox. Add an internal-to-internal firewall policy with the VIP as its destination, and enable NAT on it if the server would otherwise reply to the client directly. OPNsense: enable NAT reflection on the port-forward rule, or globally under Firewall > Settings > Advanced.
• Split-Horizon DNS: Use split-horizon DNS to resolve internal names to internal IPs, bypassing NAT entirely.

Order of Operations

Understanding the order of operations is crucial for debugging issues. Typically, DNAT happens before policy checks, and SNAT occurs after. If a rule "should match" but doesn't, it's often due to incorrect assumptions about pre- or post-NAT addresses. Packet capture on both sides of the firewall can quickly resolve such issues.

Practical Translation Table

By understanding these concepts and their practical implementations, you can effectively manage complex network configurations in enterprise environments.