Firewall vs NAT



  • I humbly apologise if my question is too stupid, but having come from only ever using ISP supplied modem/routers (and for a short time MANY years ago, a smoothwall firewall—which was very easy to use), I'm struggling with some aspects of pfSense.

    When setting firewall or NAT rules there seems to be a correlating rule in opposing section.

    I know I'm missing something, but what appears in the firewall rule seems very similar to the NAT rule.

    What's the difference?

    edit: If you'd prefer, please refer me to some "simple" documentation on it. I don't mind reading and learning myself. But everything I'm getting just confuses me more


  • LAYER 8 Netgate

    The NAT rule (a port forward) translates the destination address/port as traffic arrives on the interface.

    After that, a firewall rule passing the traffic is necessary or it will be blocked. That rule must pass the translated traffic. For instance, if you translate connections to WAN address port TCP/80 to an inside server 192.168.1.100 TCP/8080, the firewall must pass traffic destined for 192.168.1.100 TCP/8080.

    Neither will work without the other in that case.

    Hard to give you "simple" documentation on a subject that can get a little complicated. You really have to understand what a port forward is really doing. If you don't have the pfSense book (see sig) then:

    https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

    https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting



  • Thanks Derelict, I know other posts have basically said the same thing, but the succinctness of that answer is perfect (and perfectly understood). And I already have those two tabs open elsewhere in other windows. That was probably my biggest error (and I'm guessing traps a few newbies) about the destination IP and Port, and now that I've been using it a few days, it's perfectly understood. Cheers


Log in to reply