SonicOS 7 Rules and Policies

Creating a WAN-to-WAN Access Rule for a NAT64 Policy

When an IPv6-only client initializes a connection to an IPv4 client/server, the IPv6 packets received by the NAT64 translator look like ordinary IPv6 packets:

  • Source zone is LAN
  • Destination zone is WAN

After these packets are processed through the NAT policy, they are converted IPv4 packets and are handled by SonicOS again. At this point, the source zone for these packets is WAN, while the destination zone is the same as the original IPv6 packets. If the cache for these IPv4 packets is not already created, these packets undergo policy checking. In order to prevent these packets from being dropped, a WAN-to-WAN Allow access rule must be configured.

To create a WAN-to-WAN access rule

  1. Navigate to the POLICY | Rules and Policies > Access Rules page.

  2. Click +Add. The Adding Rule dialog displays.

  3. Configure the options:

    Source Zone/InterfaceWAN
    Destination Zone/InterfaceWAN
    Source AddressAny
    Source Port/ServicesAny
    Destination Port/ServicesAny
    Destination Address

    All WAN IP

    All WAN IP is the default address group created by SonicOS that includes all WAN IP addresses that belong to the firewall WAN interface(s). All WAN IP cannot be configured.
    Users IncludedAll
    Users ExcludedNone
    ScheduleAlways on
    CommentIPv4 from Any to Any for Any service (optional)
    All other optionsLeave as is or optionally configure accordingly
  4. Click Add.
  5. Click Cancel.

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.