Enable Clients on the Internal Network to Access your Public Servers (Destination U-Turn NAT)

Create an address object for the web server.
Select
Objects
Addresses
and
Add
a
Name
and optional
Description
for the address object.
For
Type
, select
IP Netmask
and enter the public IP address of the web server, 203.0.113.11 in this example.
You can switch the address object type from
IP Netmask
to
FQDN
by clicking
Resolve
, and when the FQDN appears, click
Use this FQDN
. Alternatively, for
Type
, select
FQDN
and enter the FQDN to use for the address object. If you enter an FQDN and click
Resolve
, the IP address to which the FQDN resolves appears in the field. To switch the address object
Type
from an FQDN to an IP Netmask using this IP address, click
Use this address
and the
Type
will switch to
IP Netmask
with the IP address appearing in the field.
Click
OK
.
Create the NAT policy.
Select
Policies
NAT
and click
Add
.
On the
General
tab, enter a descriptive
Name
for the NAT rule.
On the
Original Packet
tab, select the zone you created for your internal network in the
Source Zone
section (click
Add
and then select the zone) and the zone you created for the external network from the
Destination Zone
list.
In the
Destination Address
section,
Add
the address object you created for your public web server.
On the
Translated Packet
tab, for Destination Address Translation, for
Translation Type
, select
Static IP
and then enter the IP address that is assigned to the web server interface on the DMZ network, 10.1.1.11 in this example. Alternatively, you can select
Translation Type
to be
Dynamic IP (with session distribution)
and enter the
Translated Address
to be an address object or address group that uses an IP netmask, IP range, or FQDN. Any of these can return multiple addresses from DNS. If the translated destination address resolves to more than one address, the firewall distributes incoming NAT sessions among the multiple addresses based on one of several methods you can select:
Round Robin
(the default method),
Source IP Hash
,
IP Modulo
,
IP Hash
, or
Least Sessions
.
Click
OK
.
Click
Commit
.