In watchguard's guide for NAT loopback when describing the additional nat rules required, they show this image:

Add NAT screen

Why are those top two NAT rules necessary, ie aren't they already covered by the next two entries with the "any-external" aliases?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 9:01

A NAT router can have (and often has) not only a single public address but an address pool for source NAT.

The first two rules assign a specific public address to the translation. Any-External works as a fallback in case the specific address is not available or all its ports are exhausted.

  • is "Assign" is the correct term? My understanding is that the packets are "matched" based on that criteria, and then the source IP is changed (or assigned) based on the interface the packet will leave from.
    – b_levitt
    Jul 5 '18 at 21:59
  • That's another way to put it. I use "assign" as it defines the public IP address to use for a private source address.
    – Zac67
    Jul 6 '18 at 4:02
  • right, but in the case above, this old watchguard firewall does not support specifying the source IP. That's why I'm thinking those two pairs of nat rules would function identically.
    – b_levitt
    Jul 6 '18 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.