How NAT rules match traffic

NAT rules are matched based on IP addresses and services.

Each address translation operation places specific restrictions on what you can put in the cells. Consider the design of your NAT rules and Access rules separately, because attempting to match the different types of rules one-to-one is usually not effective or even possible.

To overwrite both the source and destination IP address in the same packet (for example, to achieve hairpin NAT), configure both address translations in the same NAT rule.

Tip: With element-based NAT, the same connection can separately match the source and destination NAT. Hairpin NAT is automatic.