NAT (Network Address Translation)
Masquerading (Address Masquerading)
For the address masquerading setting:
- Firewall
- General Settings
follow the menus. The Masquerading checkboxes in the table under Zones=>Forward on the incoming page can be configured. Masquerading hides the source IP address of data packets with the router's WAN IP address. The masquerading and MSS compression feature of the WAN interface must be enabled, but it should be disabled on the LAN interface.
SNAT (Source NAT)
| Parameter | Description | Default Value |
|---|---|---|
| Enable | Enable/Disable | Enable |
| Name | Name of the rule | |
| Protocol | TCP+UDP/TCP/UDP/ICMP | TCP+UDP |
| Source IP address | This rule can match a source IP address or IP range, for example, 192.168.1.100 or 192.168.1.100-192.168.1.200. "Any" matches all source IP addresses, meaning this rule covers packets that match any source IP address. | Any |
| Source Port | This rule can match a source port or port range, for example, 999 or 888-999. "Null" matches all source ports, meaning this rule covers packets that match any source port. | Null |
| Destination IP address | This rule can specify a destination IP address or IP range, for example, 192.168.2.100 or 192.168.2.100-192.168.2.200. "Null" matches all destination IP addresses, meaning this rule covers packets that match any destination IP address. | Null |
| Destination Port | This rule can specify a destination port or port range, for example, 999 or 888-999. "Null" matches all destination ports, meaning this rule covers packets that match any destination port. | Null |
| SNAT IP address | Replace the source IP address of the matching traffic with this address. | custom |
| SNAT port | Replace the source port of the matching traffic with this port, "Null" uses the original source port. | Null |
Source NAT is a special form of packet masquerading that changes the source address of a packet leaving the router. When using Source NAT, you need to disable the masquerading feature of the WAN port.
To add a Source NAT rule:
- Firewall
- Traffic Rules
follow the menus. Click the Add and edit button in the New source NAT section under the Source NAT tab.
Use the default settings to leave all source IP addresses and destination IP addresses unchanged. Then click the Save & Apply button.
In this case, we changed the source IP address leaving the router to 192.168.9.1. However, the source IP address of the ICMP packet ping request from a PC (IP: 192.168.1.114) connected to the same router to a computer (IP: 192.168.13.4) connected to the router appears as 192.168.9.1 instead of 192.168.1.114.
Port Forwarding
To add a port forwarding rule:
- Firewall
- Port Forwards
follow the menus. Port forwarding rules can assign a specific port number of the WAN network to a device belonging to the selected internal network.
| Parameter | Description | Default Value |
|---|---|---|
| Name | Name of the rule | Null |
| Protocol | TCP+UDP/TCP/UDP | TCP+UDP |
| External zone | Wired WAN, 4G, VPN | wan |
| External Port | This can be a port or port range, for example, 8000-9000. When both external and internal ports are empty, this indicates a DMZ (Demilitarized Zone) function. | Null |
| Internal Zone | LAN Name | lan |
| Internal IP address | IP address of the device | Null |
| Internal Port | This can be a port or port range, for example, 8000-9000. When both external and internal ports are empty, this indicates a DMZ (Demilitarized Zone) function. | Null |
NAT DMZ
While port forwarding rules direct a specified WAN port to an internal network device, DMZ (Demilitarized Zone) rules direct all ports belonging to the WAN interface to an internal network device. DMZ rules are set in the port forwarding interface, and in DMZ mode, there is no need to set external and internal ports.
All ports belonging to the WAN address will be directed to the internal network device 192.168.1.110.
- Port forwarding and DMZ cannot be used simultaneously.