I have a rule on a stormshield performing NAT on both the source and the destination address. It is done very simply in one rule. Example :

    --Before translation--                     --After translation--
Source     Destination       Port        Source            Destination   Port
server1    FW_WAN_interface  7474        FW_LAN_interface  computer1     7474

I want to add the same rule in a pfsense. I searched a bit and the only way I found is to do an inbound and an outbound separatly.

I have a few questions on how to do it :

  1. Does pfsense read the inbound rule before the outbond rule when the traffic come from the WAN to the LAN ?

  2. If so, will I have to adapt the second rule considering the traffic modified by the first rule ?

  • Why don't you create a 1:1 NAT?
    – sebix
    Sep 26, 2021 at 18:43
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 23, 2021 at 20:16

1 Answer 1


Generally, source NAT (SNAT, NAPT) and destination NAT (DNAT, reverse NAT, port forwarding) are each stateful. That means that if you permit packets in one direction, packets belonging to the same session in the reverse direction are also permitted automatically.

A response to an inbound DNAT session is not subject to source NAT rules even though the packet flow is outbound. Respectively, an incoming reply to an outbound SNAT session is not affected by destination NAT rules either.

Essentially, you can regard SNAT and DNAT rules as being completely separate. Basically, your rules are applied when a session is established and depending on the direction of that inital traffic. Established sessions are held in the NAT table and packets are translated according to that table.

  • "Basically, your rules are applied when a session is established and depending on the direction of that inital traffic" - If I understand well, only an inbound rule can be matched as the traffic go from the WAN to the LAN ?
    – molik
    Jul 21, 2021 at 9:13
  • Yes - inbound rules are for WAN-to-LAN / public-to-private, and outbound rules are for the reverse direction (of establishing the connection/session).
    – Zac67
    Jul 21, 2021 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.