Zyxel Firewall NAT - how to configure NAT 1 to 1 Network Address Translation on the Zyxel USG Flex H Series firewall

Key Features of 1:1 NAT:

• Direct Mapping: Connects a public IP to a private IP.
• Specific Use Cases: Ideal for situations where a direct link between an external and internal IP is needed.
• Source Network Address Translation (SNAT): Changes the source IP of outgoing traffic to the public IP.

When to Use 1:1 NAT with Real-World Examples:

1.  

   Hosting Servers:

    

   • Web Server: If your organization has a web server with a private IP of 192.168.1.10, you can map it to a public IP like 203.0.113.10. External users can access your website using the public IP, while the server remains on the private network.
   • Mail Server: A mail server with a private IP of 192.168.1.20 can be mapped to a public IP of 203.0.113.20. This allows users to send and receive emails using the public IP address.
   • FTP Server: An FTP server with a private IP of 192.168.1.30 can be accessed via a public IP of 203.0.113.30, enabling external users to upload and download files.

    

2.  

   Application Compatibility:

    

   • VoIP System: Some VoIP systems require static, public IP addresses for reliable communication. For instance, a VoIP server with a private IP of 192.168.1.40 can be mapped to a public IP of 203.0.113.40 to ensure smooth voice communication.
   • Online Gaming Server: An online gaming server with a private IP of 192.168.1.50 can be given a public IP of 203.0.113.50 to allow gamers worldwide to connect using a consistent IP address.

    

3.  

   IP-based Access Control:

    

   • Security Cameras: An organization might use 1:1 NAT to allow remote access to security cameras. A camera system with a private IP of 192.168.1.60 can be mapped to a public IP of 203.0.113.60, enabling remote monitoring while applying specific access rules.
   • Building Access Systems: For systems controlling building access, such as card readers, a device with a private IP of 192.168.1.70 can be mapped to a public IP of 203.0.113.70. This allows administrators to manage access remotely while maintaining secure access policies.

    

In summary, 1:1 NAT is useful for directly mapping external public IPs to internal private IPs, ensuring compatibility for certain applications, and implementing IP-based access control. These real-world examples demonstrate how various servers and systems can benefit from 1:1 NAT.

In this example, we will configure access to Mail Server from the WAN using Public IP

 Configuration > Network > NAT and create a new rule by clicking on the "Add" button

Then you can fill in all required fields.

• Enable NAT rule
• Give a name that captures the essence of the rule
• Select the port mapping type to "1:1 NAT"
• Incoming interface to WAN
• Source IP to Any
• External IP - use your external IP
• Internal IP - specify the ip address to which access is required
• Port Mapping Type - it depends on what you're doing (Any - all traffic will be forwarded, Service - Select a service-object (a protocol), Service-Group - Select a service-group object (a group of protocols), Port- Select a port that needs to be forwarded, Ports- Select a port range that needs to be forwarded) 
• Enable NAT loopback
• Apply all changes

NAT loopback is used inside the network to reach the internal server using the public IP. Check if NAT loopback is enabled and click OK (allows users connected to any interface to use the NAT rule too)

Set Up the Security Policy on the USG FLEX H

In this example, we will configure access to our WebServer from the WAN

Security Policy > Policy Control and create a new rule by clicking on the "Add" button 

Then you can fill in all required fields.

• Enable policy
• Give a name that captures the essence of the rule
• From - WAN
• To - LAN
• Source - Any
• Destination - lan subnet where your server is (LAN_SUBNET_GE3 in this example) or select the object created in the previous step
• Service - HTTPS
• User - Any
• Action - allow
• Apply all changes

Troubleshooting 1:1 NAT Configuration

• Verify NAT Rules: Double-check that the 1:1 NAT rules are correctly configured, ensuring that the internal IP address of your mail server is properly mapped to the correct public IP address.

• Firewall Rules: Ensure that the firewall rules are set to allow traffic on the necessary ports (e.g., port 443 for HTTPS).

• Logs and Diagnostics: Regularly monitor the firewall logs and use diagnostic tools to check the flow of traffic. This can help identify and resolve issues quickly.

• Ensure that all public IP addresses are correctly routed. To verify this, assign each public IP address to the USG FLEX H Series WAN port individually.

• Test internet access using each public IP address to confirm it is functioning correctly.

• Contact your ISP to ensure that routing for your public IP addresses is properly configured and active.