What is NAT; which types exist in TR7?

Short answer

NAT (Network Address Translation, RFC 3022) is the changing of a packet's source or destination IP address (and, if necessary, also its port) by a device on the path. If the source address is changed, it is called SNAT (Source NAT; e.g. devices in the internal network going out with a single address); if the destination address and port are changed, it is called DNAT (Destination NAT; port forwarding). In TR7, NAT appears in two places. In the Firewall, SOURCE NAT (NAT) is selected in the Rule field and the SNAT IP is specified, or DESTINATION NAT (PORT REDIRECTION) is selected and the DNAT IP is entered. In the Load Balancer, on the other hand, HTTP and L7 TCP vServices connect to the Backend Service with TR7's address by default; this is an SNAT and is determined by the SNAT field of the Backend Service (default Default). In the Network vService, whether the source address is translated is determined by the LB Mode field; if SNAT is selected, the source address is translated to the address selected in the SNAT IP field.

Where It Is Used in TR7

Where	Field / label	What for
Network → Firewall → Add	Rule = SOURCE NAT (NAT) → SNAT IP	Translating the source address of the outgoing packet to the selected TR7 address; in this rule, Interface is the interface the packet goes out of
Network → Firewall → Add	Rule = DESTINATION NAT (PORT REDIRECTION) → DNAT IP (IP:port)	Translating the destination address and port of the incoming packet
Network → Firewall list	The SNAT/DNAT column (SNAT: … / DNAT: …)	Seeing the translation target of the rule
Backend Service form → Details	SNAT: Default, Use Client IP, Use Device IP	The source address of the connection going to the server in HTTP and L7 TCP vServices
Network vService form	LB Mode	Whether the source address is translated in the Network vService; if SNAT is selected, SNAT IP
WEB-CLI	network fw-rule add (network fw-rule)	Defining a NAT rule from the command line

NAT Types in TR7

Type	Where	What changes	Detail
SNAT (Firewall)	The SOURCE NAT (NAT) rule	The source IP of the outgoing packet	Firewall · Rule
DNAT (Firewall)	The DESTINATION NAT (PORT REDIRECTION) rule	The destination IP and port of the incoming packet	What is DNAT?
SNAT (Load Balancer)	Backend Service → SNAT	The source IP of the connection going to the server	What is SNAT, and why is it used by default?

When SNAT is Default, the source address is the Interface IP, in the same subnet as the server (gateway), of the interface that goes to the server (or to the gateway leading to the server) in the route table of the Backend Service; in a cluster, each device uses its own Interface IP. The difference between the options: What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?

Common Misconceptions

• "NAT exists only in the Firewall." The Load Balancer also applies SNAT by default on the connection going to the server; for this reason, the server sees TR7's address, not the client's (Why do my backend servers see all requests as coming from TR7's IP?).
• "SNAT cannot be turned off in the Load Balancer." In HTTP and L7 TCP vServices, the connection to the server is made with the client's address by selecting Use Client IP; for this, the server responses must return through TR7 (Is it possible to work without SNAT (transparent mode); what are the requirements?).
• "Users behind NAT appear as separate clients." They share the same public outgoing address; persistence based on the source IP counts them as a single client (All users coming from behind a corporate NAT go to a single server; why?).

How it is done in the documentation

• Firewall · Rule
• Firewall · SNAT IP
• Firewall · DNAT IP
• Backend Services · SNAT

Related questions

• What is SNAT, and why is it used by default?
• What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?
• All users coming from behind a corporate NAT go to a single server; why?
• What is DNAT?