Add a DNAT rule with server access assistant

The server access assistant helps you create destination NAT (DNAT) rules for inbound traffic to internal servers.

Use this to create DNAT rules to translate incoming traffic to servers, such as web, mail, SSH, or other servers, and to access remote desktops. The assistant also creates a reflexive SNAT rule (for outbound traffic from the servers), a loopback rule (for internal users accessing the servers), and a firewall rule (to allow inbound traffic to the servers) automatically.

Creating NAT and firewall rules that meet basic requirements using the server access assistant is a simple process. To add other rule settings, you can edit these rules later.

  1. Select the server access assistant from the following options:
    • Go to Rules and policies > NAT rules. Select IPv4 or IPv6 and then select Add NAT rule. Select Server access assistant (DNAT).
    • Go to Rules and policies > Firewall rules. Select IPv4 or IPv6 protocol and select Add firewall rule. Select New firewall rule Select Server access assistant (DNAT).
  2. Specify the settings:
    OptionDescription

    Internal server IP address

    To specify the internal server to access from the internet, select an internal IP host. Alternatively, you can enter a private IP address.

    If you enter an IP address, XG Firewall automatically creates an IP host with the assigned name. You can change the name.

    To specify more than one server, edit the rules later.

    Public IP address

    Select a public IP address or WAN interface. Alternatively, you can enter a public IP address.

    If you enter an IP address, XG Firewall automatically creates an IP host with the assigned name. You can change the name.

    To specify more than one public interface or IP address, edit the rules later.

    Services

    Select the services users can access on the internal server.

    You can't create new services here. You can add them before you create the rules with the server access assistant or when you edit the rules later.

    To specify port translation, edit the rules later.

    External source networks and devices

    Select the source networks and devices from which users can access the internal server.

    To automatically create a loopback rule for internal users to access the server, select Any.

    Save and finish

    Review the settings and rules. Save the settings.

The server access assistant creates DNAT, reflexive SNAT, and loopback NAT rules for address translation and a firewall rule to allow inbound traffic to internal servers. The rules are added at the top of the NAT and firewall rule tables and are turned on by default.

The reflexive and loopback rule names carry the name and rule ID of the DNAT rule created. The firewall rule name carries the DNAT rule name.

What next

  • Reposition the rules in the NAT and firewall rule tables to meet your requirements. XG Firewall evaluates rules from top down.
  • Edit the rules to specify other settings, if required.
  • Create a firewall rule to allow outbound traffic matching the reflexive NAT rule, if required.