In watchguard's guide for NAT loopback when describing the additional nat rules required, they show this image:
Why are those top two NAT rules necessary, ie aren't they already covered by the next two entries with the "any-external" aliases?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Commented Dec 25, 2018 at 9:01
Add a comment
|
1 Answer
A NAT router can have (and often has) not only a single public address but an address pool for source NAT.
The first two rules assign a specific public address to the translation. Any-External works as a fallback in case the specific address is not available or all its ports are exhausted.
-
is "Assign" is the correct term? My understanding is that the packets are "matched" based on that criteria, and then the source IP is changed (or assigned) based on the interface the packet will leave from.– b_levittCommented Jul 5, 2018 at 21:59
-
That's another way to put it. I use "assign" as it defines the public IP address to use for a private source address.– Zac67 ♦Commented Jul 6, 2018 at 4:02
-
right, but in the case above, this old watchguard firewall does not support specifying the source IP. That's why I'm thinking those two pairs of nat rules would function identically.– b_levittCommented Jul 6, 2018 at 12:50