Main Menu
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • English English English en
  • BLOG
  • CONTACT SALES
  • FREE TRIALS
  • English English English en
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • Menu

How to configure NAT on NSSP 13700 ?

07/13/2021 0 People found this article helpful 185,317 Views

    Download
    Print
    Share
    • LinkedIn
    • Twitter
    • Facebook
    • Email
    • Copy URL The link has been copied to clipboard

    Description

    This article describes how to access an internal device or server behind the SonicWall firewall remotely from outside the network. This process is also known as opening ports, PATing, NAT or Port Forwarding.

    Resolution

    NOTE: During the initial release, NSSP 13700 is only available in global mode. In a later release, SonicOSX with Policy mode will be available for selection.

    By default, SonicWall has an implicit rule that denies all inbound traffic to something on the LAN Zone or the Custom Zone having the devices, servers behind the firewall. This is to protect internal devices from malicious access, however, it is often necessary to open up certain parts of a network, such as Servers, to the outside world.

    To accomplish this the SonicWall needs a Firewall Access Rule to allow the traffic from the public Internet to the internal network as well as a Network Address Translation (NAT) Policy to direct the traffic to the correct device.

    Manually opening port forwarding to allow traffic from the Internet to a Server behind the SonicWall using SonicOS involves the following steps:

    1. Creating the necessary Address Objects and Service Object for the custom port access.
    2. Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback
    3. Creating the necessary Firewall Access Rules

      These steps will also allow you to enable Port Address Translation with or without altering the IP Addresses involved.

    The following walk-through details allowing Terminal Service (RDP) Traffic from the Internet to a server on the LAN. Once the configuration is complete, Internet Users can access the Server via the Public IP Address of SonicWall's WAN.

    Creating the necessary Address Objects

    1. Login to the SonicWall GUI.
    2. Click Object in the top navigation menu.
    3. Click Match Objects | Addresses.
    4. Click Add and create two Address Objects for the Server's Public IP and the Server's Private IP.
    5. Click Save to add the Address Object to SonicWall's Address Object Table.


    Image

          Image

    Image                                      

    Creating the necessary Service Object

    1. Click Object in the top navigation menu
    2. Click Match Objects | Services.
    3. Click the Add button and create the necessary Service Objects for the Ports required.
    4. Ensure that you know the correct Protocol for the Service Object (TCP, UDP, etc.). If you're unsure of which Protocol is in use, perform a Packet Capture.
    5. Click Save to add the Service Object to SonicWall's Service Object Table.

    Image                      

                                                                           

    Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback

    A NAT Policy will allow SonicOS to translate incoming Packets destined for a Public IP Address to a Private IP Address, and/or a specific Port to another specific Port. Every Packet contains information about the Source and Destination IP Addresses and Ports and with a NAT Policy SonicOS can examine Packets and rewrite those Addresses and Ports for incoming and outgoing traffic.

    1. Click Policy in the top navigation menu.
    2. Click Rules and Policies| NAT Rules.
    3. Click the Add button at the bottom of the page and a pop-up window will appear.   

     For the Inbound NAT policy, select the fields as below on the Original and translated tabs. Leave all fields on the Advanced/Actions tab as default. Click on Add to add the NAT Policy to the SonicWall NAT Policy Table.  Specifying the Interfaces is a best practice.

                           Image   

    Image              

    For the Outbound NAT policy, select the fields as below on the Original and translated tabs. Leave all fields on the Advanced/Actions tab as default. Click on Add to add the NAT Policy to the SonicWall NAT Policy Table.

        Image

    Image                                              

    Loopback NAT Policy
    A Loopback NAT Policy is required when Users on the Local LAN/WLAN need to access an internal Server via its Public IP/Public DNS Name. This Policy will "Loopback" the Users request for access as coming from the Public IP of the WAN and then translate down to the Private IP of the Server. Without a Loopback NAT Policy internal Users will be forced to use the Private IP of the Server to access it which will typically create problems with DNS.
    If you wish to access this server from other internal zones using the Public IP address consider creating a Loopback NAT Policy.    

                             Image

            Image                

     Creating the necessary Firewall Access Rules

    1. Click Policy in the top navigation menu.
    2. Click Rules and Policies | Access Rules.
    3. Select the View Type as Matrix and select your WAN to Appropriate Zone Access Rule. (This will be the Zone the Private IP of the Server resides on.)
    4. Click the Add button at the bottom of the screen and in the pop-up window create the required Access Rule by configuring the fields as shown below in the Source/Destination tab. Leave all other tabs on default.
    5. Click Add when finished.

    Image



    Related Articles

    • Bandwidth usage and tracking in SonicWall
    • How to force an update of the Security Services Signatures from the Firewall GUI
    • Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

    Categories

    • Firewalls > NSsp Series > Networking

    Not Finding Your Answers?

    ASK THE COMMUNITY

    Was This Article Helpful?

    YESNO

    Article Helpful Form

    Article Not Helpful Form

    Company
    • Careers
    • News
    • Leadership
    • Awards
    • Press Kit
    • Contact Us
    Popular resources
    • Communities
    • Blog
    • SonicWall Capture Labs

    Stay In Touch

    • By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. You can unsubscribe at any time from the Preference Center.
    • This field is for validation purposes and should be left unchanged.
    • Facebook
    • Twitter
    • Linkedin
    • Youtube
    • Instagram

    © 2023 SonicWall. All Rights Reserved.

    • Legal
    • Privacy
    • English
    Scroll to top