Firewall rules and NAT

Goal

Write the classic three-zone ruleset (lan → wan allowed, dmz published inward via DNAT, everything else denied) and understand rule evaluation order.

Firewall rules

Rules are evaluated top down, first match wins. Each rule has:

• Source zone / destination zone
• Match — source and destination addresses, protocol, ports
• Action — allow or deny

A minimal secure baseline:

1. Allow lan → wan (any port, or restrict to 80/443/53 for tighter posture)
2. Allow wan → dmz only on the published service ports
3. Deny everything else (the implicit default)

NAT

Two translations cover most deployments:

• SNAT (source NAT / masquerade) — rewrites private lan source addresses to the WAN address so replies can return. Applied on egress to wan.
• DNAT (destination NAT / port forward) — rewrites the WAN address and port to an internal server, publishing a dmz service to the internet.

DNAT happens before firewall evaluation, so your wan → dmz rule must match the translated (internal) destination.

Steps

1. Open Network → Firewall and add the allow rules in order.
2. Open Network → NAT and add SNAT for lan egress and DNAT for each published service.
3. Publish and watch apply status.

Verify

• A lan client can browse the internet (SNAT works).
• The published dmz service answers on the WAN address (DNAT works).
• A connection attempt from wan to lan is dropped.

Pitfalls

• Rule order matters: a broad deny placed above your allows silently kills everything below it.
• When DNAT "doesn't work", check the firewall rule first — it must allow traffic to the internal address, not the public one.