1:1 NAT#

A 1:1 mapping gives a device behind the router a public address of its own: connections to the public address reach the device on every port, and the device's own connections leave from the public address. It needs no rule per service. A network can be mapped the same way, onto an inside network of the same size, address by address.

The 1:1 NAT table on the NAT page lists every mapping; Add 1:1 NAT opens the editor, and clicking a mapping opens it with its values.

How a mapping is made#

Each mapping is two NAT rules: one that sends connections for the public address to the inside address, and one that makes the inside address's own connections leave as the public address. The page shows them as one mapping, and adds, changes and deletes them together. Their counters are the table's Packets in and Packets out.

NAT rules are checked in number order, and the first match decides. A port forward on the same interface matches every address it arrives for, the public one included, and the masquerade that takes the network to the internet matches the inside device too. So Wheelhouse numbers a new mapping ahead of the first rule on its interface that would take its traffic — on a router with the usual masquerade at 100 and forwards from 110, at 90 — and moves an existing one ahead when an edit would leave it behind such a rule. Numbers that pending changes use are never reused.

The fields#

Field	What it does
Public address	An address, or a network: `203.0.113.10`, `203.0.113.8/29`. It must reach the router — a second address from your provider, or a network routed to you.
Inside address	The device, or a network of the same size.
Interface	Where the public address arrives.
Description	The mapping's name, shown in the table and the pending changes.
Allow connections to the inside address	New mappings only. Adds a Forward rule that accepts every connection arriving on the interface for the inside address. Off by default: a mapping translates, and the firewall still decides what gets in.
Log translations	Both rules log what they translate.
Disabled	The mapping stays in the configuration and translates nothing.

As the form is filled in, the router plans the change and the panel shows what it found under Before you apply — for example, that no Forward rule admits connections to the inside address yet, or that the public address is in the interface's own network and the router answers for it only once it is also one of the interface's addresses.

What it refuses#

The panel says why, and nothing is added:

The router's own address. Mapped, every connection to it on that interface — to the web UI, a VPN, every port forward — would go to the inside host. Use port forwards for that address.
Two addresses of different shapes. Both single addresses, or two networks of the same size.
An address already mapped, public or inside, by another mapping.
No room ahead. When every number before the rule in the way is taken, the panel names that rule; renumber it to make room.

Deleting one#

Delete 1:1 NAT asks twice, then removes both rules. A Forward rule written for the inside address is not removed with them; the notice after deleting names it, so it can be removed on the Firewall page if nothing else needs it.

Mappings made outside Wheelhouse#

The router has a kind of rule of its own for 1:1 mappings, which Wheelhouse does not write: applying it through the interface Wheelhouse uses to reach the router has been seen to stop that interface, and with it every page. A mapping of that kind made elsewhere is listed in the table, marked Read-only. Wheelhouse does not change or remove it. Once it is gone, the same mapping can be made here.