Source NAT on Juniper SRX300

Question

I'm having issues setting up the Source NAT on my SRX300 firewall. The firewall is connected to an LC-panel through a fibre optic cable in port 0/6. I have set the public ip on that interface and have configured the dns-servers and default gateway. Additionally I have a DHCP server running on Port 0/3. The SRX has a connection and can ping remote hosts, and connecting a device to Port 0/3 will give it an IP address from the Pool. The devices on Port 3 can ping the SRX but can not reach the public internet and I believe I'm missing something in my source NAT config.

Here is my nat security (203.0.113.192/30 being a stand in for my public IP):

security {
    nat {
        source {
            pool src-nat-pool-1 {
                address {
                    203.0.113.192/30;
                }
            }
            rule-set rs1 {
                from zone trust;
                to zone untrust;
                rule r1 {
                    match {
                        source-address 0.0.0.0/0;
                        destination-address 0.0.0.0/0;
                    }
                    then {
                        source-nat {
                            pool {
                                src-nat-pool-1;
                            }
                        }
                    }
                }
            }
        }
    }
    policies {
        from-zone trust to-zone trust {
            policy trust-to-trust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
        from-zone trust to-zone untrust {
            policy trust-to-untrust {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
            policy internet-access {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit;
                }
            }
        }
    }
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                ge-0/0/2.0;
                ge-0/0/3.0;
                ge-0/0/4.0;
                ge-0/0/5.0;
                ge-0/0/6.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                        }
                    }
                }
            }
        }
        security-zone untrust {
            screen untrust-screen;
        }
    }
}

And the relevant interfaces are configured as follows:

interfaces {
    ge-0/0/3 {
        unit 0 {
            family inet {
                address 192.168.3.1/24;
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family inet {
                address 203.0.113.192/30;
            }
        }
    }
}

Sadly I can't even seem to get any translation hits.

Answer 1

Hello and welcome to NetworkEngineering!

1. Change your source-nat pool... to source-nat interface in SNAT config.

2. Remove interface ge-0/0/6.0 from trust zone to untrust.

[edit]

delete security nat source rule-set rs1 rule r1 then source-nat
set security nat source rule-set rs1 rule r1 then source-nat interface

delete security zones security-zone trust interfaces ge-0/0/6.0
set security zones security-zone untrust interfaces ge-0/0/6.0