Tip

This is the documentation for the 20.02 version. Looking for the documentation of the latest version? Have a look here.

Static NAT

Static NAT entries alter traffic, redirecting it to a static host on an internal network, or mapping it to a static address on the way out:

tnsr(config)# nat pool addresses <external address>
tnsr(config)# nat static mapping (icmp|tcp|udp) local <local address> [local port]
                  external (external address|external interface) [external port]
                  [twice-nat] [out-to-in-only] [route-table <rt-tbl-name>]

There are two common use cases for static NAT in practice: Port Forwarding and 1:1 NAT.

Warning

Remember to add the address of the outside interface as a part of a NAT pool (NAT Pool Addresses) or the static NAT entry will fail to commit.

Warning

The out-to-in-only and twice-nat features require endpoint-dependent NAT mode. In TNSR 18.11 and later, this is the default mode.

The following commands set TNSR to endpoint-dependent NAT mode:

tnsr(config)# dataplane nat mode endpoint-dependent
tnsr(config)# service dataplane restart

Port Forwards

Port forwards redirect a port on an external NAT pool address to a port on a local host. A port forward is accomplished by specifying ports in the static NAT command:

tnsr(config)# nat pool addresses 203.0.113.2
tnsr(config)# nat static mapping tcp local 10.2.0.5 22 external 203.0.113.2 222

In the above example, a TCP connection to port 222 on 203.0.113.2 will be forwarded to port 22 on 10.2.0.5. The source address remains the same.

1:1 NAT

1:1 NAT, also called One-to-One NAT or in some cases “Network Address Translation”, maps all ports of an external address for a given protocol to an an internal address. This mapping works for inbound and outbound packets. To create a 1:1 mapping, make a static NAT entry which does not specify any ports:

tnsr(config)# nat pool addresses 203.0.113.3
tnsr(config)# nat static mapping tcp local 10.2.0.5 external 203.0.113.3

Twice NAT

Twice NAT changes both the source and destination address of inbound connection packets. This works similar to a static NAT port forward, but requires an additional NAT address specification.

First, add the internal address for source translation:

tnsr(config)# nat pool addresses 10.2.0.2 twice-nat

Next, add the external address to which the client originally connects:

tnsr(config)# nat pool addresses 203.0.113.2

Finally, add the static mapping which sets up the destination translation:

tnsr(config)# nat static mapping tcp local 10.2.0.5 22 external 203.0.113.2 222 twice-nat

In the above example, a TCP connection to port 222 on 203.0.113.2 will be forwarded to port 22 on 10.2.0.5. When the packet leaves TNSR, the source is translated so the connection appears to originate from 10.2.0.2 using a random source port.

Warning

This feature requires endpoint-dependent NAT mode. In TNSR 18.11 and later, this is the default mode.

The following commands set TNSR to endpoint-dependent NAT mode:

tnsr(config)# dataplane nat mode endpoint-dependent
tnsr(config)# service dataplane restart