Step-by-step configuration guide for setting up Port Address Translation on SonicWall firewalls, including Address Objects, Service Objects, NAT Policies, and Access Rules.
Step-by-step configuration guide for setting up Port Address Translation on SonicWall firewalls, including Address Objects, Service Objects, NAT Policies, and Access Rules.
A. Address Objects
Create two address objects: one for the internal device (e.g. a printer on the LAN) and one for the public-facing IP on the WAN.
A1 — Internal Device
| |
|---|
| Name | (Printer) |
| Zone Assignment | LAN |
| Type | Host |
| IP Address | (x.x.x.x) |
A2 — Public IP
| |
|---|
| Name | (Public IP) |
| Zone Assignment | WAN |
| Type | Host |
| IP Address | (x.x.x.x) |
B. Service Objects
Create two service objects: one for the incoming (external) port and one for the outgoing (internal) port.
B1 — Incoming Service
| |
|---|
| Name | PAT (incoming) |
| Protocol | TCP(6) |
| Port Range | (incoming port e.g. 9112-9112) |
B2 — Outgoing Service
| |
|---|
| Name | PAT (outgoing) |
| Protocol | TCP(6) |
| Port Range | (outgoing port e.g. 9100-9100) |
C. NAT Policies
Three NAT policies are required: the primary PAT rule, a reflective rule for internal-to-external traffic, and a loopback rule for LAN-to-LAN access via the public IP.
NAT Policy — PAT (Primary)
| |
|---|
| Name | PAT |
| Original Source | Any (e.g. 0.0.0.0/0) |
| Translated Source | Original |
| Original Destination | (A2) |
| Translated Destination | (A1) |
| Original Service | (B1) |
| Translated Service | (B2) |
| Inbound Interface | X1 |
| Outbound Interface | Any |
NAT Policy — PAT (Reflective)
| |
|---|
| Name | PAT (reflective) |
| Original Source | (A1) |
| Translated Source | (A2) |
| Original Destination | Any |
| Translated Destination | Original |
| Original Service | (B2) |
| Translated Service | Original |
| Inbound Interface | Any |
| Outbound Interface | X1 |
NAT Policy — PAT (Loopback)
| |
|---|
| Name | PAT (loopback) |
| Original Source | Firewalled Subnets |
| Translated Source | (A2) |
| Original Destination | (A2) |
| Translated Destination | (A1) |
| Original Service | (B1) |
| Translated Service | (B2) |
| Inbound Interface | Any |
| Outbound Interface | Any |
D. Access Rules (SonicOS 6)
Create an access rule to permit inbound WAN traffic on the translated service to reach the internal device.
| |
|---|
| Name | PAT |
| Action | Allow |
| From | WAN |
| To | LAN |
| Source Port | Any (e.g. 0.0.0.0/0) |
| Service | (B1) |
| Source | Any (e.g. 0.0.0.0/0) |
| Destination | (A2) |
| Users Included | All |
| Users Excluded | None |
| Schedule | Always on |
| Priority | Retain original priority |
D. Access Rules (SonicOS 7)
SonicOS 7 uses a redesigned Access Rules interface. Configure source and destination separately as shown below.
Rule Name: PAT
Source
| |
|---|
| Zone/Interface | WAN |
| Address | Any (e.g. 0.0.0.0/0) |
| Port/Services | Any |
Destination
| |
|---|
| Zone/Interface | LAN |
| Address | (A2) |
| Port/Services | (B1) |
