Full NAT No NAT SNAT

Check out the Online Help:

• • SNAT (source): Maps the source address of defined IP packets to one new source address. The service can be changed, too.

Note – You have to add the SNAT rules before you activate the Web Filter. Sophos UTM priorities Web Filter settings higher than SNAT rules. If you select a SNAT rule while the Web Filter is activated the rule may not work. You can activate or deactivate the Web Filter on the Web Protection > Web Filtering > Global page.

• DNAT (destination): Maps the destination address of defined IP packets to one new destination address. The service can be changed, too.
• 1:1 NAT (whole networks): Maps IP addresses of a network to another network one-to-one. The rule applies either for the source or for the destination address of the defined IP packets.
• Full NAT (source + destination): Maps both the source address and the destination address of defined IP packets to one new source and one new destination address. The source service and the target service can be changed, too.
• No NAT: This option can be regarded as a kind of exception rule. For example, if you have a NAT rule for a defined network you can create a No NAT rule for certain hosts inside this network. Those hosts will then be exempted from NAT.

Matching Condition: Add or select the source and destination network/host and the service for which you want to translate addresses. How to add a definition is explained on the Definitions & Users > Network Definitions > Network Definitions page.

In addition to Toni's post, you will want to read Accessing Internal or DMZ Webserver from Internal Network and consider #2 in Rulz.

Also, note that the list of NAT rules is an ordered (numbered) list.  For a NoNAT rule to be effective, it must be above the NAT rule for which it is an "exception."  All ordered lists are processed in order and no further rules are applied once the traffic matches a rule.

Cheers - Bob

thank Q, this makes me clear about Full NAT

thank q, this is good explanation