Skip to main content
NAT & Port Forwarding

Port Forwarding, PAT, and NAT Without the Guesswork

Map internal services to external ports with a single rule builder that covers port forwarding, 1:1 NAT, and configurable outbound NAT - plus automatic pattern detection that suggests matching rules during setup.

🔀 DNAT · SNAT · MASQUERADE · 1:1 NAT

Every NAT Mode, One Rule Builder

Inbound and outbound translation live in the same interface as firewall rules - no separate NAT console to jump between.

Port Forward (DNAT)
Expose a single internal service - a web server, mail server, or remote-access port - through a specific external port while the rest of the network stays hidden behind NAT.
Outbound NAT (SNAT / MASQUERADE)
Automatic, hybrid, or fully manual rules control how internal addresses are translated as traffic leaves the WAN interface.
1:1 NAT
Map an entire internal host to a dedicated external address, one-to-one, for servers that need a consistent public identity.
PAT
Share a single external IP across many internal hosts by multiplexing connections onto unique source ports - the default behavior behind most outbound rules.

Anatomy of a Port Forward Rule

Every NAT rule is built from the same fields - name it, pick the direction, and tell it where the translated traffic goes.

Example Rule - Web Server NAT
Type: DNATProtocol: tcpIncoming Interface: wanIncoming Port: 80Translate To: 192.168.1.10:8080Logging: onEnabled
Traffic hitting the WAN on port 80 is translated to the web server's internal address and port - everything else on that host stays hidden.

Automatic, Hybrid, or Fully Manual Outbound NAT

Choose how much control you want over how internal addresses look once they reach the internet.

Automatic
Firecradle generates and maintains outbound MASQUERADE rules for every WAN interface - no manual rule to keep in sync as interfaces change.
Hybrid
Keep the automatic rules running and layer your own manual SNAT or MASQUERADE exceptions on top for specific hosts or subnets.
Manual
Turn off automatic generation entirely and define every outbound SNAT/MASQUERADE rule yourself, in priority order.

Real-World Use Cases

Publishing a Web Server Behind One Public IP

Challenge: A business has one public IP and needs to expose an internal web server without giving the outside world direct access to the rest of the LAN.

How it's handled:
✅A single DNAT rule maps WAN:443 to the web server's internal address and port
✅Every other internal host stays unreachable from the WAN
✅Logging enabled on the rule to track every forwarded connection
✅Rule sits alongside the matching firewall allow rule in the same rule builder

Multiple Services, One Public IP

Challenge: A branch office runs a mail server and a remote-access service but only has a single public IP address to work with.

How it's handled:
✅Two port-forward rules on the same external IP, different external ports
✅PAT keeps every outbound connection from internal hosts sharing that IP distinct
✅Rules ordered by priority so the more specific rule matches first
✅No additional public IP addresses required

Key Advantages

✅One rule builder: port forwarding, 1:1 NAT, and outbound NAT share the same screen as firewall rules
✅Automated pattern detection suggests NAT and port forward rules during setup
✅Outbound NAT modes range from fully automatic to fully manual - your choice
✅Per-rule logging tracks every translated connection
✅No extra licensing for 1:1 NAT or additional port forwards

Expose Exactly What You Need - Nothing Else

Port forwarding, 1:1 NAT, and outbound NAT rules included in every Firecradle appliance.

No credit card required · Cancel anytime · 30-day free trial