Destination NAT

Destination NAT is performed on incoming packets when the firewall translates a destination address to a different destination address; for example, it translates a public destination address to a private destination address. Destination NAT also offers the option to perform port forwarding or port translation.
Destination NAT allows static and dynamic translation:
  • Static IP—You can configure a one-to-one, static translation in several formats. You can specify that the original packet have a single destination IP address, a range of IP addresses, or a list of single IP addresses, as long as the translated packet is in the same format and specifies the same number of IP addresses. The firewall statically translates an original destination address to the same translated destination address each time. That is, if there is more than one destination address, the firewall translates the first destination address configured for the original packet to the first destination address configured for the translated packet, and translates the second original destination address configured to the second translated destination address configured, and so on, always using the same translation.
  • Dynamic IP (with session distribution)—Destination NAT allows you to translate the original destination address to a destination host or server that has a dynamic IP address, such as an address group or address object that uses an IP netmask, IP range, or FQDN, any of which can return multiple addresses from DNS. Dynamic IP (with session distribution) supports IPv4 addresses only. Destination NAT using a dynamic IP address is especially helpful in cloud deployments that use dynamic IP addressing.
    If an FQDN in the translated destination address resolves to more than one address, the firewall automatically distributes translated sessions in a round-robin manner to provide improved session distribution. (If a DNS server returns more than 32 IPv4 addresses for an FQDN, the firewall uses the first 32 addresses in the packet.)
    Using Dynamic IP (with session distribution) allows you to translate multiple pre-NAT destination IP addresses M to multiple post-NAT destination IP addresses N. A many-to-many translation means there can be M x N destination NAT translations using a single NAT rule.
If the translated address is an address object of type FQDN that resolves to only IPv6 addresses, the destination NAT policy rule considers the FQDN as unresolved.
The following are common examples of destination NAT translations that the firewall allows:
Translation Type
Original Packet’s Destination Address
Maps to Translated Packet’s Destination Address
Notes
Static IP
192.168.1.1
2.2.2.2
Original packet and translated packet each have one possible destination address.
192.168.1.1-192.168.1.4
2.2.2.1-2.2.2.4
Original packet and translated packet each have four possible destination addresses:
192.168.1.1 always maps to 2.2.2.1
192.168.1.2 always maps to 2.2.2.2
192.168.1.3 always maps to 2.2.2.3
192.168.1.4 always maps to 2.2.2.4
192.168.1.7
192.168.1.4
192.168.1.253
192.168.1.1
2.2.2.1
2.2.2.2
2.2.2.3
2.2.2.4
Original packet and translated packet each have four possible destination addresses:
192.168.1.7 always maps to 2.2.2.1
192.168.1.4 always maps to 2.2.2.2
192.168.1.253 always maps to 2.2.2.3
192.168.1.1 always maps to 2.2.2.4
192.168.1.1/30
2.2.2.1/30
Original packet and translated packet each have four possible destination addresses:
192.168.1.1 always maps to 2.2.2.1
192.168.1.2 always maps to 2.2.2.2
192.168.1.3 always maps to 2.2.2.3
192.168.1.4 always maps to 2.2.2.4
Dynamic IP (with session distribution)
192.168.1.1/30
domainname.com
Original packet has four destination addresses and if, for example, the FQDN in the translated destination address resolves to five IP addresses, then there are 20 possible destination NAT translations in a single NAT rule.
One common use for destination NAT is to configure several NAT rules that map a single public destination address to several private destination host addresses assigned to servers or services. In this case, the destination port numbers are used to identify the destination hosts. For example:
  • Port Forwarding—Can translate a public destination address and port number to a private destination address but keeps the same port number.
  • Port Translation—Can translate a public destination address and port number to a private destination address and a different port number, thus keeping the actual port number private. The port translation is configured by entering a Translated Port on the Translated Packet tab in the NAT policy rule. See the Destination NAT with Port Translation Example.

Related Documentation