Currently I have set 1:1 NAT to translate 1 public IP to 1 private IP but is there any way to set multiple public IPs to one private IP on NSA 2400? Or I need to set another 1:1 NAT with different private IP and add that IP as secondary to that device from the first NAT?

1 Answer 1


You certainly can do MANY:1 NAT -- that is: have several Public WAN IPs point to 1 internal LAN IP.

Just create Address Objects for each WAN IP and put those Address Objects into an Address Object Group. Then create your NAT (and Firewall) rule using the Address Object GROUP. Inbound Internet traffic destined to any of the Public IPs in the Address Object Group will be NAT'd to the internal IP.

So, for example, if you have 3 ISPs and one internal LAN looking something like:

X1: WAN1
X2: WAN2 thru .6
X3: WAN3 and .9

And you want to use a Public IP from each ISP: select which IPs and create Address Objects for each (in my example the X1 WAN IP Object will be the only IP for that interface, for X2 and X3 you will need to create Objects for the IPs you want) such as:

X1 WAN IP (something like this already exists)
X2 Public .5  (create this Object =
X3 WAN IP  (something like this already exists for the .8 IP)

Put all of them into an Address Object Group called: SERVER-16 Public IPs (or whatever)

Then create an inbound NAT rule that uses that Address Object Group for the Destination, like:

Original Source: Any
Translated Source: Original
Original Destination: SERVER-16 Public IPs    (your GROUP)
Translated Destination: SERVER-16 Private IP  (IP of your server on the LAN
Original Service: HTTP   (or whatever service)
Translated Service: Original
Inbound Interface: Any
Outbound Interface: X0   (the LAN interface)

You will need to create a similar Firewall rule from WAN > LAN using SERVER-16 Public IPs as the Destination (since it is a NAT rule), the same Service, and Any as the Source.

I have done this on several SonicWALL devices and it works just fine.

PS: You could probably set multiple 1:1 inbound NAT rules if you'd prefer, but that just gets messy with many WAN IPs, and when you want to make changes.

For OUTBOUND return traffic the SonicWALL will send the data back using the original inbound interface (so if someone connects to the X3 IP it will come back to the user via X3.

For OUTBOUND original traffic -- meaning browsing from SERVER-16 for Updates NTP time updates, etc -- the outbound interface/IP will be determined by the Outbound NAT rules and likely the Load Balancing settings and routes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.