# How to create NAT rules on Edge Gateway

## <mark style="color:green;">**Overview**</mark> <a href="#overview" id="overview"></a>

Network address translation (NAT) allows the source or destination IP address to be changed to enable traffic to transition through a gateway or router.

HI GIO supports some NAT types:

> A **SNAT** rule translates the source IP address of packets sent from an organization's VDC network out to an external network or another organization's VDC network.
>
> A **NO SNAT** rule prevents the translation of the internal IP address of packets sent from an organization VDC out to an external network or another organization VDC network.
>
> A **DNAT** rule translates the IP address and, optionally, the port of packets received by an organization VDC network that are coming from an external network or another organization VDC network.
>
> A **NO DNAT** rule prevents the translation of the external IP address of packets received by an organization VDC from an external network or another organization VDC network.

{% hint style="warning" %}
The public IP addresses must have been added to the edge gateway interface where you want to add the NAT rule.
{% endhint %}

{% hint style="warning" %}
Firewall rule will be applied to the local IP address by default configuration. If you want to specify a firewall rule for the Public IP address, please change the "Firewall Match" configuration to "Match External Address" on the Advanced option
{% endhint %}

## <mark style="color:green;">**Procedure**</mark> <a href="#procedure" id="procedure"></a>

{% tabs %}
{% tab title="I. Creating a DNAT\No DNAT rule" %}
**Step 1:** In the top navigation bar, click **Networking** and **Edge Gateways**.

**Step 2:** Select the edge gateway that you want to edit

<figure><img src="/files/XTDYQtezB1CpMvrmK4jn" alt=""><figcaption></figcaption></figure>

**Step 3:** Under *Security*, click **NAT**

**Step 4:** Click **New**.

**Step 5:** Configure an **DNAT**

*<mark style="color:blue;">**Name**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[Name of rule]</mark>

*<mark style="color:blue;">**Description**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[optional]</mark>

*<mark style="color:blue;">**Interface type**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">Select DNAT\No DNAT</mark>

*<mark style="color:blue;">**External IP**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">Enter the</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**public IP address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">of the edge gateway</mark>

*<mark style="color:blue;">**External Port**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[optional - Enter a port into which the DNAT rule is translating]</mark>

*<mark style="color:blue;">**Internal IP**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">Enter IP or range IP to receive traffic from the external network</mark>

*<mark style="color:blue;">**Application**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[optional – select application profile with port]</mark>

*<mark style="color:blue;">**Advanced Settings**</mark><mark style="color:blue;">: (Optional)</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**State**</mark><mark style="color:blue;">: Enable or disable the NAT rule.</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Logging**</mark><mark style="color:blue;">: Toggle the Logging button to enable logging</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Priority**</mark><mark style="color:blue;">: A lower value means a higher priority. The default is 0. A No SNAT or No DNAT rule should have a higher priority than other rules.</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Firewall Match**</mark><mark style="color:blue;">: The available settings are</mark>*

* *<mark style="color:blue;">**Match External Address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- The firewall will be applied to external address of a NAT rule.</mark>*

<mark style="color:blue;">For SNAT, the external address is the translated source address after NAT is done.</mark>

<mark style="color:blue;">For DNAT, the external address is the original destination address before NAT is done.</mark>

* <mark style="color:blue;">**Match Internal Address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- Indicates the firewall will be applied to internal address of a NAT rule.</mark>

&#x20;       *<mark style="color:blue;">For SNAT, the internal address is the original source address before NAT is done.</mark>*

&#x20;       *<mark style="color:blue;">For DNAT, the internal address is the translated destination address after NAT is done.</mark>*

* <mark style="color:blue;">**Bypass**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- The packet bypasses firewall rules</mark>

<figure><img src="/files/DZgLWyKYiVNQMH3S8cyi" alt=""><figcaption></figcaption></figure>

**Step 6:** Click **Save**
{% endtab %}

{% tab title="II. Creating a SNAT\No SNAT rule" %}
**Step 1:** In the top navigation bar, click **Networking** and **Edge Gateways**.

**Step 2:** Select the edge gateway that you want to edit

<figure><img src="/files/PKmlzk9ez1ETFfGdY5qD" alt=""><figcaption></figcaption></figure>

**Step 3:** Under *Security*, click **NAT**

**Step 4:** Click **New**.

**Step 5:** Configure an SNAT

*<mark style="color:blue;">**Name**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[Name of rule]</mark>

*<mark style="color:blue;">**Description**</mark>*<mark style="color:blue;">: \[optional]</mark>

*<mark style="color:blue;">**Interface type:**</mark>* <mark style="color:blue;">Select SNAT\No SNAT</mark>

*<mark style="color:blue;">**External IP**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">Enter the</mark> <mark style="color:blue;"></mark><mark style="color:blue;">**public IP address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">of the edge gateway</mark>

*<mark style="color:blue;">**Internal IP**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">Enter IP or range IP to receive traffic from the external network</mark>

*<mark style="color:blue;">**Destination IP**</mark><mark style="color:blue;">:</mark>* <mark style="color:blue;"></mark><mark style="color:blue;">\[Optional]</mark>

*<mark style="color:blue;">**Advanced Settings**</mark><mark style="color:blue;">: (Optional)</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**State**</mark><mark style="color:blue;">: Enable or disable the NAT rule.</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Logging**</mark><mark style="color:blue;">: Toggle the Logging button to enable logging</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Priority**</mark><mark style="color:blue;">: A lower value means a higher priority. The default is 0. A No SNAT or No DNAT rule should have a higher priority than other rules.</mark>*

<mark style="color:blue;">-</mark> <mark style="color:blue;"></mark>*<mark style="color:blue;">**Firewall Match**</mark><mark style="color:blue;">: The available settings are</mark>*

* *<mark style="color:blue;">**Match External Address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- The firewall will be applied to external address of a NAT rule.</mark>*

<mark style="color:blue;">For SNAT, the external address is the translated source address after NAT is done.</mark>

<mark style="color:blue;">For DNAT, the external address is the original destination address before NAT is done.</mark>

* <mark style="color:blue;">**Match Internal Address**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- Indicates the firewall will be applied to internal address of a NAT rule.</mark>

&#x20;       *<mark style="color:blue;">For SNAT, the internal address is the original source address before NAT is done.</mark>*

&#x20;       *<mark style="color:blue;">For DNAT, the internal address is the translated destination address after NAT is done.</mark>*

* <mark style="color:blue;">**Bypass**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">- The packet bypasses firewall rules</mark>

<figure><img src="/files/cHPfVnHv4EaTTi35F8iB" alt=""><figcaption></figcaption></figure>

**Step 6:** Click **Save**

<mark style="color:red;">Note: Please do not remove SNAT/DNAT rules name starting with</mark> <mark style="color:red;"></mark><mark style="color:red;">**HIGIO-**</mark> <mark style="color:red;"></mark><mark style="color:red;">(if any)</mark>

**Step 7:** Add Edge Firewall rules for SNAT/DNAT after completing NAT rules.
{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.higiocloud.vn/network/1.-working-with-network/how-to-create-nat-rules-on-edge-gateway.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.