What is DNAT?

Short answer

DNAT (Destination NAT, RFC 2663) is changing the destination IP address and, if needed, the port of an incoming packet and forwarding the request to another address; for this reason it is also known as port forwarding. For example, TCP traffic that comes to an address of TR7 on port 8443 can be forwarded to port 443 of a server in the internal network. In TR7, a user DNAT is defined by selecting DESTINATION NAT (PORT REDIRECTION) in the Rule field on the Network → Firewall screen; the redirection target is written in the required DNAT IP field as an address or as IP:port, and the match is determined with the Protocol, Source, Destination IP and Destination Port fields. DNAT redirects to a single target; distributing traffic to more than one server and monitoring the servers with health check is the job of a vService. TR7 also produces its own DNAT rules for management access and some vService types; these are seen in the Auto-generated Rules table below the Firewall list.

Where It Is Used in TR7

Where	Field / label	What for
Network → Firewall → Add	Rule = DESTINATION NAT (PORT REDIRECTION) → DNAT IP (required)	Redirecting incoming traffic to another address or port
Network → Firewall list	SNAT/DNAT column (DNAT: …)	Seeing the redirection target of the rule
Network → Firewall → Auto-generated Rules	Descriptions such as HTTP access DNAT rule, ANY-DNAT rule for "…", GTM DNAT rule	Seeing the DNATs that TR7 produces for management access, Network vService (ANY - L3) and GTM (they cannot be edited)
WEB-CLI	network fw-rule add (network fw-rule)	Defining a DNAT rule from the command line

DNAT and vService

	DNAT (Firewall rule)	vService
What it does	Redirects the packet to a single target	Distributes the traffic among Backend Services
Monitoring of the target	None	With health check; a server that does not respond is taken out of the distribution
Layer	L3/L4 (address and port)	L3/L4 in Network vService; in HTTP and L7 TCP, the connection terminates on TR7
Logging and monitoring	At the Firewall rule level	vService logs, sessions and Dashboard

Common Misconceptions

• "Load balancing is done with DNAT." DNAT redirects to a single target; distribution and health check are done with a vService.
• "DNAT changes only the port." If only an address is written in the DNAT IP field, the destination address changes; if IP:port is written, the address and the port change together.
• "User NAT rules do not affect management access." User SNAT/DNAT rules are evaluated before the DNATs that TR7 produces for management access; a user NAT rule that covers the management address or port can redirect access to the web interface and to SSH elsewhere. While NAT rules are being changed, a second management session should be kept open (Rule evaluation order).

How it is done in the documentation

• Firewall · Rule
• Firewall · DNAT IP
• Firewall · The Rule Evaluation Order
• Firewall · The Auto-Generated Rules

Related questions

• What is NAT; which types exist in TR7?
• What is a port; where are ports set in TR7?
• What is Management Access; with which settings does TR7 protect management access?