NAT and PBR

Goal

Translate addresses with NAT and steer selected flows with policy-based routing (PBR).

Prerequisites

• Working L3 addressing from Addresses and routing.
• network.write.

NAT

1. Open Network → NAT / PBR.
2. Create a NAT rule (type such as SNAT, DNAT, 1:1, or MASQUERADE—per form options).
3. Set match criteria and translation targets.
4. Publish and test with a known client flow.

PBR

1. In the same section, create a PBR rule (match + target table / next hop as exposed in the UI).
2. Keep PBR tables consistent with static routes that use non-default table ids.
3. Publish after NAT when both change in one maintenance window—or publish separately for safer rollback.

Tips

• Masquerade outbound WAN traffic before opening broad inbound DNAT.
• Document which firewall rules must allow post-NAT traffic.
• Roll back the network snapshot if a DNAT change breaks a production service.

Verify

• NAT/PBR rows list under NAT / PBR.
• Expected source/destination addresses appear in session or packet captures on Linux appliances.

Related

• Firewall rules
• VPN tunnels