4.1 Dynamic NAT (Source NAT)

4.1 Dynamic NAT (Source NAT)

Quick Answer: Dynamic NAT in Fireware OS is a form of many-to-one or many-to-few Source NAT (SNAT/PAT) that translates private RFC 1918 source IP addresses on internal networks to globally routable public IP addresses on the External interface. Fireware provides two default Dynamic NAT rules: Any-Trusted -> Any-External and Any-Optional -> Any-External. Ephemeral Layer 4 ports (1024–65535) disambiguate concurrent client connections sharing the same public IP. Default idle timeouts are 3600 seconds (1 hour) for established TCP, 60 seconds for half-closed TCP, and 30 seconds for UDP and ICMP.

Foundations of Network Address Translation & RFC 1918

In modern enterprise networks, internal client devices, printers, and application servers are almost universally assigned private IPv4 addresses defined by RFC 1918:

• 10.0.0.0/8 (10.0.0.0 to 10.255.255.255)
• 172.16.0.0/12 (172.16.0.0 to 172.31.255.255)
• 192.168.0.0/16 (192.168.0.0 to 192.168.255.255)

Internet service providers and backbone transit routers drop packets containing RFC 1918 source or destination addresses by design. For an internal host with IP address 10.0.1.50 to communicate with an external web server at 198.51.100.25, an intermediate Layer 3 device must rewrite the packet header so that the source IP appears as a globally routable public address. In WatchGuard Fireware OS, this outbound translation mechanism is called Dynamic NAT.

Port Address Translation (PAT) / IP Masquerading Mechanics

Because an enterprise may possess hundreds or thousands of internal endpoints but only a small block of public IP addresses—often only a single static or dynamic public IP assigned by an ISP—Dynamic NAT operates as Port Address Translation (PAT), historically also referred to as IP masquerading.

When an internal host initiates an outbound TCP, UDP, or ICMP flow, the Firebox intercepts the packet at the ingress interface (such as a Trusted or Optional interface) and performs the following sequence of operations:

1. Route and Policy Lookup: The Firebox checks its routing table and firewall policies. If a policy permits the outbound traffic (for example, the default Outbound or an HTTP-proxy policy), the packet progresses to the NAT engine.
2. Source IP Translation: The Firebox strips the original private source IP address (10.0.1.50) and replaces it with the primary IP address of the egress External interface (e.g., 203.0.113.2).
3. Source Port Remapping: The Firebox examines the client's Layer 4 source port (e.g., source port 51234). If another active connection is already using port 51234 on that public IP, or to ensure deterministic state isolation, the Firebox allocates a unique ephemeral source port from its dynamic pool (e.g., port 34567).
4. Checksum Recalculation: Because the IP header and Layer 4 TCP/UDP headers have been modified, the Firebox recalculates both the IP header checksum and the Layer 4 transport checksum.
5. State Table Insertion: The Firebox records a stateful mapping tuple in its internal dynamic NAT table: [Protocol: TCP | Internal IP: 10.0.1.50 | Internal Port: 51234 | Translated IP: 203.0.113.2 | Translated Port: 34567 | Destination IP: 198.51.100.25 | Destination Port: 80]
6. Egress Forwarding: The packet is transmitted out the physical External interface toward the ISP.

When the remote server replies, it directs packets to Destination IP: 203.0.113.2 and Destination Port: 34567. The Firebox inspects the packet, matches the tuple in its state table, reverses the translation—substituting 10.0.1.50 and port 51234—recalculates checksums, and forwards the packet onto the internal Trusted network.

---

Default Dynamic NAT Rules in Fireware

When a Firebox is initialized through the Quick Setup Wizard or loaded with a factory-default configuration in Policy Manager or Fireware Web UI, it automatically creates two global Dynamic NAT rules under Network > NAT > Dynamic NAT:

1. Rule 1: Any-Trusted -> Any-External
2. Rule 2: Any-Optional -> Any-External

+--------------------------------------------------------------------------------+
|                             Fireware Dynamic NAT                               |
+-----------------------+------------------------+-------------------------------+
| Source                | Destination            | Translated Source IP          |
+-----------------------+------------------------+-------------------------------+
| Any-Trusted           | Any-External           | Primary External Interface IP |
| Any-Optional          | Any-External           | Primary External Interface IP |
+-----------------------+------------------------+-------------------------------+

Characteristics of Default Rules

• Universal Egress Coverage: Any device residing on any interface configured as Trusted or Optional that establishes an outbound connection to any destination reachable via an External interface has its source IP dynamically translated.
• Interface IP Binding: By default, the translated source IP is dynamically set to the primary IP address of whichever External interface the routing engine selects as the egress gateway.
• Multi-WAN Awareness: If the Firebox uses Multi-WAN (e.g., dual ISPs on External Interface 0 and External Interface 2), traffic routed out Interface 0 is translated to Interface 0's IP, while traffic routed out Interface 2 is translated to Interface 2's IP automatically.
• Exclusion of Custom Interfaces: Note that interfaces configured with the Custom zone type are not included in the default Dynamic NAT rules. If administrators connect internal subnets to Custom interfaces and desire Internet access, they must manually add a Dynamic NAT rule for Any-Custom -> Any-External.

---

Custom Dynamic NAT Rules & Public IP Pools

While the default rules satisfy typical small office or branch deployments, complex enterprise networks frequently require custom Dynamic NAT definitions. Custom rules override or augment the default rules to address two primary architectural requirements:

1. Translating specific internal subnets to dedicated public IP addresses (e.g., separating guest Wi-Fi from corporate traffic).
2. Managing large outbound connection volumes that would otherwise exhaust the 65,535 ephemeral port limit of a single public IP.

Configuring Source IP Pools

To configure a custom Dynamic NAT rule in Fireware Web UI (Network > NAT > Dynamic NAT) or Policy Manager (Network > Configuration > NAT > Dynamic NAT tab), the administrator specifies:

• Source Subnet / Alias: An IP address, network range, CIDR subnet, or alias (e.g., 10.0.50.0/24 for Guest-Wireless).
• Destination Interface / Network: The egress interface or destination subnet (e.g., Any-External).
• Source IP Address for Translation: Instead of the default "Use interface IP", the administrator chooses either:
  • A specific secondary IP address configured on the External interface (e.g., 203.0.113.10).
  • A contiguous range or pool of public IP addresses (e.g., 203.0.113.10 - 203.0.113.14).

Ephemeral Port Exhaustion & NAT Pooling

A single IPv4 address has $65,535$ transport ports. Approximately $1,024$ are reserved well-known ports, leaving roughly $64,500$ ephemeral ports for dynamic translation. In heavy enterprise environments—such as universities, call centers, or trading floors where thousands of users generate dozens of concurrent HTTP/HTTPS connections each—a single public IP can run out of available ports. When port exhaustion occurs, the Firebox cannot allocate a source port and drops new outbound connection attempts, logging NAT table exhaustion errors.

By assigning a public IP pool (e.g., a /29 block containing 5 usable public IPs) to the Dynamic NAT rule, Fireware multiplies the available ephemeral port capacity by five ($5 \times \sim 64,500 \approx 322,500$ concurrent sessions). The Firebox distributes outbound flows across the IP pool using a round-robin or source-IP hashing algorithm.

---

Dynamic NAT Table Management & Connection Tracking

The Firebox NAT engine is fully stateful. Every active connection consumes an entry in volatile RAM. To maintain state integrity without exhausting memory, Fireware enforces strict connection state tracking and idle expiration timers.

Connection State Tracking Lifecycle

[Client Initiates SYN] ---> [Firebox Allocates Port & Creates NAT Table Entry]
                                            |
[TCP 3-Way Handshake Completes] -----------> [State: ESTABLISHED (Timeout: 3600s)]
                                            |
[Idle Data Flow] ---------------------------> [Timer resets on each packet match]
                                            |
[FIN / RST Termination] --------------------> [State: TIME_WAIT / CLOSE (Timeout: 60s)]
                                            |
[Timer Expires] ----------------------------> [NAT Table Entry Purged, Port Released]

Fireware NAT Timeout Standards

• TCP Established Timeout (Default: 3600 seconds / 1 hour): Once the TCP three-way handshake (SYN, SYN-ACK, ACK) completes, the session enters the ESTABLISHED state. If no packets traverse the connection for 3,600 seconds, the Firebox purges the NAT table entry. Any packet arriving resets this timer to 3,600 seconds.
• TCP Half-Closed / Closing Timeout (Default: 60 seconds): When a TCP FIN or RST segment is observed, the connection enters a closing teardown state. Fireware holds the NAT mapping for 60 seconds to permit delayed in-flight packets or final acknowledgments before releasing the ephemeral port.
• UDP Idle Timeout (Default: 30 seconds): Because UDP is connectionless without handshake or teardown flags, Fireware cannot track protocol state. It maintains the NAT table entry for 30 seconds after the last observed packet. Applications requiring persistent UDP connectivity (such as VoIP SIP/RTP or DNS tunnels) must transmit periodic keepalive packets to prevent the NAT mapping from expiring.
• ICMP Timeout (Default: 30 seconds): ICMP Echo Request/Reply sessions are held in the NAT table for 30 seconds, using the ICMP Identifier field to correlate replies with internal requesting hosts.

---

Handling Asymmetric Routing in Dynamic NAT

Asymmetric routing occurs when an outbound packet leaves the local network through one gateway (such as the Firebox), but the return packet returns through a different path or router that bypasses the Firebox state table.

Because Dynamic NAT rewrites the packet's source IP address to the Firebox's own External interface IP, Dynamic NAT inherently eliminates asymmetric routing on the public Internet boundary. The remote Internet server knows only the Firebox's public IP and is physically incapable of routing the return packet to any destination other than the Firebox External interface. As long as the Firebox receives the return packet, it matches the NAT table entry and returns the packet to the internal client.

However, asymmetric routing can still arise on the internal side if internal subnets have multiple Layer 3 paths to other internal networks and Dynamic NAT is incorrectly applied to inter-subnet traffic. For this reason, Fireware's default Dynamic NAT rules specifically match Any-External as the destination, ensuring internal inter-VLAN and site-to-site BOVPN traffic is never subjected to source NAT unless explicitly mandated.

---

Operational Verification & Monitoring

Fireware provides multiple diagnostic interfaces to verify active Dynamic NAT translations, monitor ephemeral port utilization, and troubleshoot dropped packets:

1. Firebox System Manager (FSM) Traffic Monitor

When a packet matches a policy with Dynamic NAT enabled, the Traffic Monitor logs the translation event:

2026-09-21 14:20:10 Allow 10.0.1.50 198.51.100.25 http/tcp 51234 80 1-Trusted 0-External Proxy-HTTP: Allowed (NAT: 203.0.113.2:34567)

The log clearly illustrates the pre-NAT source (10.0.1.50:51234), the post-NAT source (203.0.113.2:34567), and the ingress and egress physical interfaces.

2. FSM Status Report

In FSM, the Status Report tab displays the total active connections, memory allocated to connection state tracking, and NAT table statistics.

3. Fireware Command-Line Interface (CLI)

Connecting via SSH or console (port 4118) provides direct real-time inspection:

• show nat table — Lists all current dynamic NAT state table mappings, including source IP, remapped port, and active idle timer countdowns.
• diagnose firewall connection — Displays detailed stateful connection tuples, protocol flags, and byte counters.