Setting up 1:1 NAT
Now that we know what 1:1 NAT is and what it’s good for, let’s set up a public Web server. Assume that we’ve created a DNS entry that binds
to the public IP address 207.29.194.204, which we are going to represent as our external IP address for 1:1 NAT. In reality, this Web server is connected to the Optional interface of our Firebox, listening for HTTP requests sent to the private IP address 10.10.10.4.
From the Policy Manager’s Menu Bar, choose Setup, then NAT… Click on the Advanced… button in the NAT Setup window. (If Enable Dynamic NAT is checked, leave this setting alone, since it is the default NAT policy for all hosts behind your firewall.) From the 1-to-1 NAT Setup Tab, select Enable 1-to-1 NAT, then choose Edit… Select External as the interface, then select the number of servers you want to NAT. To keep this example simple, we’ll NAT one server on our trusted network. The server’s private address, 10.10.10.4, is the Real Base. An unused public IP address, 207.29.194.204, is the NAT Base.
Your 1:1 NAT is now established, but you must still create an exception policy to your default Dynamic NAT. If you don't, when the outside world sends packets to 207.29.194.204 (the public-facing 1:1 NAT IP you've just set up), your Firebox will dutifully perform Dynamic NAT (since that’s the default policy), and your server's responses will say they come from your Firebox's IP address. This bad practice can create undesired results. But using the Firebox's Dynamic NAT Exceptions feature, you can allow your server to show its 1:1 NAT IP, instead of the Firebox's external IP. Here's how to do it. From the Dynamic NAT Exceptions tab, choose Add… then add an exception from 10.10.10.4 to external.
Your 1:1 NAT is now configured to map all inbound connect requests to this server. Since 10.10.10.4 is a Web server, you would configure your Firebox to further restrict server access to Web only: for our purposes, we’ll add Filtered-HTTP (80) and HTTPS (443) services. For both services, enable and allow incoming traffic received on the public IP address 207.29.194.204. If your server must communicate with other public servers, you must enable and allow outgoing traffic from this server. Enable logging. Reboot your Firebox and test your configuration.
