@tknospdr said in How to read FW rules in plain English:
Packet arrives to my WAN interface and says "I'm here to see PUBLIC_IP in apartment 3290.
NAT rule says, "Hmm they're actually looking for 192.168.2.2 in apt 32400, but before I send them on their way, let's see if the doorman will allow it"
Doorman says "My rulebook says packets from PUBLIC_IP visiting 2.2:3400 are welcome here"
Close !
This order :
Packet arrives to my WAN interface and says "I'm here to see PUBLIC_IP in apartment 3290.
Doorman says "My rulebook says packets from PUBLIC_IP visiting 2.2:3400 are welcome here"
NAT rule says, "Hmm they're actually looking for 192.168.2.2 in apt 32400, but before I send them on their way, let's see if the doorman will allow it"
Where doorman = the WAN firewall rule (created by the NAT rule).
So, first, an incoming packet has to be allowed by this fire wall rule.
The packet can now enter the router and the attached NAT rule will kick in : it will replace the source IP of the packet with the destination IP for the local LAN IP, like 192.168.1.22. If needed, the original destination port number can also be changed, but this is optional. In your case it was originally '32400' and it sated '32400'.
The NAT rule (and firewall rule) is statefull : the answers from the traffic going to 192.168.1.22 will get remapped in reverse, so a bidirectional data stream can take place.
