Source NAT#

Source NAT changes the address traffic leaves the router from, which is what lets a network of private addresses reach the internet. The Source NAT table on the NAT page lists every rule with its live counters; Add source NAT rule adds one, and clicking a rule opens it.

The table#

Column	What it shows
#	The rule number.
Description	Its description, and Disabled when it is.
Source	The addresses the rule applies to, or Any.
Interface	Where the traffic leaves, or Any.
Leaves as	Interface address, or a fixed address.
Packets / Bytes	The router's counters for the rule.

Interface address — masquerade — uses whatever address the interface has at the time, which is the only thing that works on a DHCP or PPPoE uplink. A fixed address sends the traffic from that address instead.

The editor#

Field	What it does
Description	The rule's name.
Rule number	New rules only — see below.
Interface	Where the traffic leaves, chosen from the router's interfaces. Required.
Source	An address, a network or a range the rule applies to; empty for every source.
Leaves as	The interface's address, or A fixed address with the address, network or range to use.
Only for traffic to	Destination, Protocol and Destination port, for a rule that applies to some traffic only. A port needs TCP, UDP or TCP and UDP.
Log translations	Every translation is logged.
Disabled	The rule stays in the configuration and translates nothing.

Where a new rule goes#

Source rules are checked in number order and the first match decides. The masquerade the installer writes matches every source leaving the uplink, so a rule numbered after it never applies. The editor suggests a number before the first rule that would take the new rule's traffic, and when a number typed by hand is behind one it says so under the field: Rule 100 matches this traffic first, so this rule would never apply.

Delete rule asks twice, then removes the rule.

What the installer writes#

When the installer's NAT box is left checked and there is both a WAN and a LAN with an address, it writes one rule: LAN to WAN, number 100, the LAN's network leaving by the uplink as the interface's address. A second segment — a guest VLAN, another network behind the router — is not covered by it and leaves with private addresses until it has a rule of its own, which is what Add source NAT rule is for.

Per-uplink rules from the Uplinks page#

A second uplink gets its masquerade from the Uplinks page: the add-uplink wizard offers it, and an uplink with no source NAT rule gets a panel offering one. The Uplinks table's NAT column names each uplink's rule. When WAN load balancing masquerades by itself, the Uplinks page says so instead of offering a rule.

Other rules this table shows#

A port forward reachable from inside on the public address adds a source rule of its own — see port forwards.
A 1:1 mapping is two rules, one of them a source rule; it is listed in the 1:1 table rather than here.