Destination NAT
Network Address Translation (NAT) is the process that enables a single device, such as a router or firewall, to act as an agent between the internet or public network and a local or private network. This agent acts in real-time to translate the source or destination IP address of a client or server on the network interface. NAT can be subdivided into two types:
-
Source NAT (SNAT)
-
Destination NAT (DNAT)
This section is about DNAT. For information about SNAT, see Source NAT.
A virtual IP (VIP) maps external IP addresses to internal IP addresses for DNAT. See Configuring VIPs and Configuring VIP groups.
The following types of VIPs can be created:
|
Static VIP |
A virtual IP that maps an IP address or range to another IP address or range. Custom settings can allow the VIP to be filtered by Source Address and/or services, so that the VIP only applies to the filtered traffic. See Static virtual IPs. |
|
Static VIP with services |
A virtual IP that defines services for a single port number mapping. See Virtual IP with services. |
|
Static VIP with port forwarding |
A virtual IP that hides the port number for an internal server or maps several internal servers to the same public IP address. See Virtual IPs with port forwarding. See also . |
|
FQDN-based VIP |
A virtual IP mapped to an FQDN. See Configure FQDN-based VIPs. |
|
Virtual server load balancing |
A special type of virtual IP used to implement server load balancing. See Virtual server load balance. Virtual IPs can also be used for server load balance multiplexing. See Virtual server load balance multiplexing. |
|
Central DNAT |
Where DNAT is configured by creating virtual IPs and selecting the VIPs in firewall policies, central NAT is not configured in the firewall policy. Central NAT is enabled in System Settings. When enabled, the Policy & Objects tree displays the Central SNAT policy option. Use the Central SNAT policy to configure VIPs as separate objects. During use, FortiGate reads the enabled NAT rules from the top down, until it locates a matching rule. See Central DNAT. |