Firewall NAT Technologies · Topic 2 of 3
Destination NAT and Bidirectional NAT
Learn destination NAT on USG firewalls, static and dynamic mapping, and interzone and intrazone bidirectional NAT, with the security policy each one needs.
- 6 min
- Destination NAT changes the destination of incoming traffic so outside users can reach an inside server.
- NAT Server is the most common destination NAT; a NAT policy can also perform destination NAT, statically or from a pool.
- Destination NAT happens before the security policy check, so the policy uses the translated private destination.
What it is
Destination NAT translates the destination address, and often the port, of traffic arriving at the firewall. Outside users send to an address they know, and the firewall forwards the traffic to the real, usually private, address of a server.
Bidirectional NAT translates both the source and the destination of the same flow. It is used when destination NAT alone would leave the server unable to send its reply back through the firewall.
How it works
Destination NAT and NAT Server
The firewall offers two ways to translate destinations.
| Method | How it is configured | Typical use |
|---|---|---|
| NAT Server | nat server command, a fixed public to private mapping | Publishing an inside web, mail or FTP server |
| Destination NAT policy | nat-policy rule with a destination NAT action | Redirecting traffic that matches zones, addresses and services |
NAT Server is the classic form and has its own page. A destination NAT policy matches traffic like any NAT rule, by source zone, addresses and service, and rewrites the destination.
The mapping can be static, one fixed address or port to another, or dynamic, where the new destination is taken from a destination address pool. A common case is a fixed client, such as a mobile app, that still sends to an old server address after the server has moved.
Destination NAT happens early
On a USG firewall, destination translation happens before the route lookup and the security policy check. The firewall must know the real destination first, so it can choose the outbound interface and zone.
So the security policy matches the private, translated destination address, and the destination zone is the zone of the real server, for example DMZ.
| NAT direction | Translation point | Address used in the security policy |
|---|---|---|
| Source NAT | After the security policy | Original private source |
| Destination NAT or NAT Server | Before the security policy | Translated private destination |
Bidirectional NAT
Bidirectional NAT is not a separate command. It is a destination translation, usually NAT Server, plus a source NAT policy that matches the same traffic. Two scenarios appear in the course.
| Scenario | Who talks to whom | Why source NAT is added |
|---|---|---|
| Interzone NAT | Untrust users reach a DMZ server | The server sees a source on its own subnet and needs no route back to the internet |
| Intrazone NAT | Trust users reach a Trust server by its public address | The reply must return through the firewall, not go straight to the client |
Interzone bidirectional NAT
An internet client 1.1.1.1 browses to the published address 202.1.1.5. NAT Server changes the destination to the DMZ server 10.2.0.7. A source NAT rule from Untrust to DMZ then changes the source from 1.1.1.1 to an address of a pool on the server's subnet, such as 10.2.0.100.
The server replies to 10.2.0.100, which the firewall owns. It does not need a default gateway pointing at the firewall, and the firewall translates both addresses back.
Intrazone bidirectional NAT
Users at 192.168.1.0/24 and a server at 192.168.1.50 are all in the Trust zone. Users browse to the server's public address 202.1.1.5, so NAT Server sends the request to 192.168.1.50.
Without source NAT, the server sees a source on its own subnet and replies directly to the user. The user expected a reply from 202.1.1.5, receives one from 192.168.1.50, and drops it. A source NAT rule within the Trust zone changes the user's source to a firewall address, so the reply goes back through the firewall.
A worked example
A DMZ web server at 10.2.0.7 has no default route, because the administrators want it to reach only its own subnet. Internet users must still reach it through 202.1.1.5.
The engineer configures NAT Server for 202.1.1.5 to 10.2.0.7, a NAT policy from Untrust to DMZ that translates sources to a pool in 10.2.0.0/24, and a security policy from Untrust to DMZ permitting HTTP to 10.2.0.7. This is interzone bidirectional NAT, and the server answers every client as if it were local.
How the exam asks about this
- "Which address must the security policy use as the destination when NAT Server is configured?" -> The private address of the server.
- "Users and a server are in the same zone and access the server by its public address. What else is needed?" -> Source NAT for that traffic, which is intrazone bidirectional NAT.
- "What does bidirectional NAT translate?" -> Both the source address and the destination address of the same flow.
What to remember for the exam
- Destination NAT changes the destination of incoming traffic so outside users can reach an inside server.
- NAT Server is the most common destination NAT; a NAT policy can also perform destination NAT, statically or from a pool.
- Destination NAT happens before the security policy check, so the policy uses the translated private destination.
- Bidirectional NAT is destination NAT plus source NAT on the same flow.
- Interzone bidirectional NAT spares the server a return route; intrazone bidirectional NAT forces replies back through the firewall.
In intrazone NAT the firewall must also inspect traffic within one zone, so check that the intrazone security policy permits it on your firewall version rather than assuming intrazone traffic always passes.
Common mistakes
Putting the public server address in the security policy. Destination translation has already happened when the policy is checked, so a rule that matches the public address never matches.
Treating bidirectional NAT as one feature. It is built from two features, destination NAT and source NAT, configured for the same traffic.
Forgetting why intrazone NAT is needed. The problem is the reply, which bypasses the firewall when the client and server are on the same subnet, not the request.
Check yourself
Why does the firewall perform destination NAT before the route lookup?
It must know the real destination address to choose the outbound interface and destination zone for the security policy check.
What problem does interzone bidirectional NAT solve?
The server sees the client as an address on its own subnet, so it can reply without a route or gateway back to the internet.
In intrazone NAT, what would happen without the source NAT rule?
The server would reply directly to the user from its private address, and the user would drop the reply because it expected the public address.
Topic 2 of 3 in Firewall NAT Technologies
Test yourself on Firewall NAT Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.