• SonicOS 7 Rules and Policies
• Access Rules
  • Setting Firewall Access Rules
    • About Stateful Packet Inspection Default Access Rules
    • About Connection Limiting
    • Using Bandwidth Management with Access Rules
      • Enabling Bandwidth Management on an Access Rule
    • Configuring Access Rules
      • Configuring Access Rules for IPv6
      • Configuring Access Rules for NAT64
      • Access Rules for DNS Proxy
      • User Priority for Access Rules
      • Displaying Access Rules
        • By Zones
        • By Column
      • Configuring Access Rules for a Zone
    • Enabling and Disabling Access Rules
    • Editing Access Rules
    • Deleting Access Rules
    • Restoring Access Rules to Default Settings
    • Displaying Access Rule Traffic Statistics
  • Access Rule Configuration Examples
    • Enabling Ping
    • Blocking LAN Access for Specific Services
    • Allowing WAN Primary IP Access from the LAN Zone
• NAT Rules
  • About NAT in SonicOS
  • About NAT Load Balancing
    • Determining the NAT LB Method to Use
    • Caveats
    • How Load Balancing Algorithms are Applied
    • Sticky IP Algorithm Examples
      • Example One - Mapping to a Network
      • Example Two - Mapping to an IP Address Range
  • About NAT64
    • Use of Pref64::/n
  • About FQDN-based NAT
  • About Source MAC Address Override
  • Viewing NAT Policy Entries
    • Changing the Display
    • Filtering the Display
    • Displaying Information about Policies
  • Adding or Editing NAT or NAT64 Policies
  • Deleting NAT Policies
  • Creating NAT Rule Policies: Examples
    • Creating a One-to-One NAT Policy for Inbound Traffic
    • Creating a One-to-One NAT Policy for Outbound Traffic
    • Inbound Port Address Translation via One-to-One NAT Policy
    • Inbound Port Address Translation via WAN IP Address
    • Creating a Many-to-One NAT Policy
    • Creating a Many-to-Many NAT Policy
    • Creating a One-to-Many NAT Load Balancing Policy
    • Creating a NAT Load Balancing Policy for Two Web Servers
    • Creating a WAN-to-WAN Access Rule for a NAT64 Policy
    • DNS Doctoring
• Routing Rules
  • About Routing
    • About Metrics and Administrative Distance
      • About Metrics
      • About Administrative Distance
    • Route Advertisement
    • ECMP Routing
    • Policy-based Routing
    • Policy-based TOS Routing
    • PBR Metric-based Priority
    • Policy-based Routing and IPv6
    • OSPF and RIP Advanced Routing Services
      • About Routing Services
        • Protocol Type
        • Maximum Hops
        • Split-Horizon
        • Poison Reverse
        • Routing Table Updates
        • Subnet Sizes Supported
        • Autonomous System Topologies
      • OSPF Terms
    • Drop Tunnel Interface
    • App-based Routing
  • Rules and Policies > Routing Rules
    • Configuring Routing Rules
      • Adding Static Routes
      • Probe-Enabled Policy-based Routing Configuration
• Content Filter Rules
  • About Content Filtering Rules (CFS)
    • About Content Filter Rules
    • About UUIDs for CFS Policies
    • About Content Filter Objects
    • How CFS Works
  • Configuring CFS Policies
    • About the Content Filter Rule Table
      • Searching the Content Filter Rule Table
    • Adding a Content Filter Rule
    • Editing a Content Filter Rule
    • Deleting Content Filter Rules
• App Rules
  • About App Rules
    • What are App Rules?
      • About App Rules Policies
      • About App Rules Capabilities
    • Benefits of App Rules
    • How Does Application Control Work?
    • About App Rules Policy Creation
    • Licensing App Rules and App Control
    • Terminology
  • Rules and Policies > App Rules
    • Configuring an App Rules Policy
    • Using the App Rule Wizard
  • Verifying App Rules Configuration
    • Useful Tools
      • Wireshark
      • Hex Editor
  • App Rules Use Cases
    • Creating a Regular Expression in a Match Object
    • Policy-based Application Rules
    • Logging Application Signature-based Policies
    • Compliance Enforcement
    • Server Protection
    • Hosted Email Environments
    • Email Control
    • Web Browser Control
    • HTTP Post Control
    • Forbidden File Type Control
    • ActiveX Control
    • FTP Control
      • Blocking Outbound Proprietary Files Over FTP
      • Blocking Outbound UTF-8 / UTF-16 Encoded Files
      • Blocking FTP Commands
    • Bandwidth Management
    • Bypass DPI
    • Custom Signature
    • Reverse Shell Exploit Prevention
      • Generating the Network Activity
      • Capturing and Exporting the Payload to a Text File Using Wireshark
      • Creating a Match Object
      • Defining the Policy
• Endpoint Rules
• SonicWall Support
  • About This Document

Inbound Port Address Translation via WAN IP Address

This is one of the more complex NAT policies you can create on a firewall running SonicOS/X — it allows you to use the WAN IP address of the firewall to provide access to multiple internal servers. This is most useful in situations where your ISP has only provided a single public IP address, and that IP address has to be used by the firewall’s WAN interface (by default, the X1 interface).

Below, create the programming to provide public access to two internal web servers through the firewall’s WAN IP address; each is tied to a unique custom port. It is possible to create more than two as long as all the ports are unique.

To use the WAN IP address of the firewall to provide access to multiple internal servers

1. Create two custom service objects for the unique public ports the servers respond on. See Create Services.
2. Create two address objects for the servers’ private IP addresses. See Create Addresses.
3. Create two NAT policies to allow the two servers to initiate traffic to the public internet. See Create Outbound NAT Policies.
4. Create two NAT policies to map the custom ports to the actual listening ports, and to map the private IP addresses to the firewall’s WAN IP address. See Create Inbound NAT Policies.
5. Create two access rules to allow any public user to connect to both servers via the firewall’s WAN IP address and the servers’ respective unique custom ports. See Create Access Rules.

To create an inbound port address translation policy via WAN IP address

Create Services

1. Navigate to the OBJECT | Match Objects > Services page.
2. Click +Add. The Service Objects dialog displays.
3. Create two Service Objects. For Name, enter your custom service object names, such as servone_public_port and servtwo_public_port.
4. For each, select TCP(6) as the Protocol.
5. Enter 9100 as the starting and ending ports for servone_public_port.
6. Enter 9200 as the starting and ending ports for servtwo_public_port.

7. After configuring each custom service, click Save to save the custom services.

8. After configuring both custom services, click Close.

Create Addresses

1. Navigate to the OBJECT | Match Objects > Addresses page. Create two Address Objects.
2. Click +Add. The Address Object Settings dialog displays.
3. For Name, enter your custom address object name, such as servone_private_ip and servtwo_private_ip.
4. Select the zone that the servers are in from the Zone Assignment drop-down menu.
5. Choose Host from the Type drop-down menu.
6. Enter the server’s private IP addresses in the IP Address field.

7. After configuring each address object, click Save to create the address object.

8. After configuring both address objects, click Close.

Create Outbound NAT Policies

1. Navigate to the POLICY | Rules and Policies > NAT Rules page.
2. Click +Add. The Adding NAT Rule Two_Serversdialog displays.

3. To create two NAT policies to allow both servers to initiate traffic to the public internet using the firewall’s WAN IP address, configure the two sets of options shown in the Option Choices: Two Servers to Initiate Traffic to the Internet table.

   Option Choices: Two Servers to Initiate Traffic to the Internet

   Options	Server One Values	Server Two Values
   Original Source	servone_private_ip	servtwo_private_ip
   Translated Source	WAN Interface IP	WAN Interface IP
   Original Destination	Any	Any
   Translated Destination	Original	Original
   Original Service	Any	Any
   Translated Service	Original	Original
   Inbound Interface	X3	X3
   Outbound Interface	X1	X1
   Comment	Enter a short description	Enter a short description
   Enable NAT Policy	Checked	Checked
   Create a reflexive policy	(dimmed)	(dimmed)

4. After configuring the NAT policy for each server, click Add to add and activate that NAT policy.

5. After configuring both NAT policies, click Cancel.

   With these policies in place, the firewall translates the servers’ private IP addresses to the public WAN IP address when it initiates traffic out the WAN interface (by default, the X1 interface).

Create Inbound NAT Policies

1. Click +Add on the POLICY | Rules and Policies > NAT Rules page again. The Adding NAT Rule dialog displays.

2. To create two NAT policies to map the custom ports to both servers’ real listening ports and to map the firewall’s WAN IP address to the servers’ private addresses, configure the two sets of options shown in the Option Choices: Mapping Custom Ports to Servers table.

   Option Choices: Mapping Custom Ports to Servers

   Options	Server One Values	Server Two Values
   Original Source	Any	Any
   Translated Source	Original	Original
   Original Destination	WAN Interface IP	WAN Interface IP
   Translated Destination	servone_private_ip	servtwo_private_ip
   Original Service	servone_public_port	servtwo_public_port
   Translated Service	HTTP	HTTP
   Inbound Interface	X1	X1
   Outbound Interface	Any	Any Make sure you choose Any as the destination interface and not the interface that the server is on.
   Comment	Enter a short description	Enter a short description
   Enable NAT Policy	Checked	Checked
   Create a reflexive policy	Cleared	Cleared

3. After configuring the NAT policy for each server, click Add to add and activate that NAT policy.

4. After configuring both NAT policies, click Cancel.

Create Access Rules

1. Navigate to the POLICY | Rules and Policies > Access Rules page.
2. Click +Add. The Adding Rule dialog displays.

3. To create the two access rules that allow anyone from the public Internet to access the two web servers using the custom ports and the firewall’s WAN IP address, configure the two sets of options shown in the Option Choices: Creating Access Rules table.

   Option Choices: Creating Access Rules

   Options	Server One Values	Server Two Values
   Action	Allow	Allow
   Zone/Interface	WAN	WAN
   Address	Zone assigned to server	Zone assigned to server
   Source Port/Services	Any	Any
   Service	servone_public_port	servtwo_public_port
   Destination Zone/Interface	Any	Any
   Destination Address	WAN Interface IP	WAN Interface IP
   Users Included	All	All
   Users Excluded	None	None
   Schedule	Always on	Always on
   Logging	checked	checked
   Comment	Enter a short description	Enter a short description

4. After configuring the access rule for each server, click Add to add and activate that access rule.

5. After configuring both access rules, click Cancel.

Test and Verify

To verify, attempt to access the web servers via the firewall’s WAN IP address using a system located on the public internet on the new custom port (for example: http://67.115.118.70:9100 and http://67.115.118.70:9200). You should be able to successfully connect. If not, review this section and ensure that you have configured all required settings correctly.