How to perform an inbound and outbound NAT at the same time in Pfsense?

Question

I have a rule on a stormshield performing NAT on both the source and the destination address. It is done very simply in one rule. Example :

    --Before translation--                     --After translation--
Source     Destination       Port        Source            Destination   Port
server1    FW_WAN_interface  7474        FW_LAN_interface  computer1     7474

I want to add the same rule in a pfsense. I searched a bit and the only way I found is to do an inbound and an outbound separatly.

I have a few questions on how to do it :

1. Does pfsense read the inbound rule before the outbond rule when the traffic come from the WAN to the LAN ?

2. If so, will I have to adapt the second rule considering the traffic modified by the first rule ?

Answer 1

Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same session in the reverse direction are also permitted automatically.

A response to an inbound DNAT session is not subject to source NAT rules even though the packet flow is outbound. Respectively, an incoming reply to an outbound SNAT session is not affected by destination NAT rules either.

Essentially, you can regard SNAT and DNAT rules as being completely separate. Basically, your rules are applied when a session is established and depending on the direction of that inital traffic. Established sessions are held in the NAT table and packets are translated according to that table.