{"id":85,"date":"2022-03-11T04:22:20","date_gmt":"2022-03-11T09:22:20","guid":{"rendered":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/chapter\/chapter-3-nat\/"},"modified":"2025-12-11T14:29:57","modified_gmt":"2025-12-11T19:29:57","slug":"source-nat","status":"publish","type":"chapter","link":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/chapter\/source-nat\/","title":{"raw":"3.1 Source NAT","rendered":"3.1 Source NAT"},"content":{"raw":"
\r\n

Learning Objectives<\/p>\r\n\r\n<\/header>\r\n

\r\n
    \r\n \t
  • Configure a NAT policy in FortiGate<\/li>\r\n \t
  • Identify source NAT<\/li>\r\n<\/ul>\r\n<\/div>\r\n<\/div>\r\n
    Scenario<\/strong>: We are going to enable Source NAT (SNAT) to reach the Internet from Kali. That means that all traffic from the local network to the Internet should be allowed.<\/div>\r\n \r\n\r\n[caption id=\"attachment_84\" align=\"aligncenter\" width=\"1125\"]\" Figure 3.1: Main scenario[\/caption]\r\n

    Source NAT<\/h2>\r\n
    \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
    Table 3.1: Devices configuration<\/caption>\r\n
    Device<\/th>\r\nIP address<\/th>\r\nAccess<\/th>\r\n<\/tr>\r\n
    Kali<\/td>\r\nDHCP Client<\/td>\r\n-<\/td>\r\n<\/tr>\r\n
    WordPress\/Kali<\/td>\r\nDHCP Client<\/td>\r\n-<\/td>\r\n<\/tr>\r\n
    Ethernet Switch<\/td>\r\n-<\/td>\r\n-<\/td>\r\n<\/tr>\r\n
    FortiGate<\/td>\r\nPort 2 - (192.168.1.1\/24) -<\/span> DHCP Server (192.168.1.10 to 192.168.1.20)\r\n\r\nPort 3 - DHCP Client\r\n\r\nPort 4 - 10.10.10.1\/24<\/td>\r\nICMP-HTTP-HTTPS<\/td>\r\n<\/tr>\r\n
    WebTerm<\/td>\r\n10.10.10.2\/24<\/td>\r\n-<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/div>\r\n

    Basic Configuration<\/h2>\r\n
      \r\n \t
    1. Port configuration in the firewall as follows:\r\n\r\n[caption id=\"attachment_84\" align=\"aligncenter\" width=\"930\"]\"Port Figure 3.2: Ports configuration in the firewall[\/caption]<\/li>\r\n \t
    2. Set a DHCP server on interface port2 (Range of IP address should be: 192.168.1.10 to 192.168.1.20, DNS: 4.2.2.4).\r\n\r\n[caption id=\"attachment_80\" align=\"aligncenter\" width=\"400\"]\"Set Figure 3.3: DHCP Server configuration[\/caption]<\/li>\r\n \t
    3. Set port3 as a DHCP client and connect to the NAT.\r\n\r\n[caption id=\"attachment_81\" align=\"aligncenter\" width=\"450\"]\"Set Figure 3.4: DHCP client configuration[\/caption]<\/li>\r\n \t
    4. Set a static route in the firewall to reach to NAT object.\r\n\r\n[caption id=\"attachment_84\" align=\"aligncenter\" width=\"648\"]\"Set Figure 3.5: Set a static route[\/caption]<\/li>\r\n \t
    5. Go to Policy & Objects > Firewall Policy<\/strong> section, click Create New<\/strong> to add a new firewall policy, and configure the following settings:\r\n
        \r\n \t
      • Name: LocalToInternet<\/strong><\/li>\r\n \t
      • From inside to outside (port2 to port3)<\/strong><\/li>\r\n \t
      • Source: Create an address for the local network<\/strong> (Subnet: 192.168.1.0\/24)<\/li>\r\n \t
      • Destination: all<\/strong><\/li>\r\n \t
      • Schedule: Always<\/strong><\/li>\r\n \t
      • Service: Only HTTP, HTTPS, and DNS<\/strong><\/li>\r\n \t
      • Action: Accept<\/strong><\/li>\r\n<\/ul>\r\n[caption id=\"attachment_84\" align=\"aligncenter\" width=\"648\"]\"Configure Figure 3.6: Configure Firewall Policy and enable Source NAT[\/caption]<\/li>\r\n \t
      • Open the browser in Kali, you should be able to access the internet.\r\n\r\n[caption id=\"attachment_84\" align=\"aligncenter\" width=\"500\"]\"you Figure 3.7: Verify your configuration[\/caption]<\/li>\r\n<\/ol>","rendered":"
        \n
        \n

        Learning Objectives<\/p>\n<\/header>\n

        \n
          \n
        • Configure a NAT policy in FortiGate<\/li>\n
        • Identify source NAT<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
          Scenario<\/strong>: We are going to enable Source NAT (SNAT) to reach the Internet from Kali. That means that all traffic from the local network to the Internet should be allowed.<\/div>\n

           <\/p>\n

          \"Source
          Figure 3.1: Main scenario<\/figcaption><\/figure>\n

          Source NAT<\/h2>\n
          \n\n\n\n\n\n\n\n\n
          Table 3.1: Devices configuration<\/caption>\n
          Device<\/th>\nIP address<\/th>\nAccess<\/th>\n<\/tr>\n
          Kali<\/td>\nDHCP Client<\/td>\n–<\/td>\n<\/tr>\n
          WordPress\/Kali<\/td>\nDHCP Client<\/td>\n–<\/td>\n<\/tr>\n
          Ethernet Switch<\/td>\n–<\/td>\n–<\/td>\n<\/tr>\n
          FortiGate<\/td>\nPort 2 – (192.168.1.1\/24) –<\/span> DHCP Server (192.168.1.10 to 192.168.1.20)<\/p>\n

          Port 3 – DHCP Client<\/p>\n

          Port 4 – 10.10.10.1\/24<\/td>\n

          		ICMP-HTTP-HTTPS<\/td>\n<\/tr>\n
          WebTerm<\/td>\n10.10.10.2\/24<\/td>\n–<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

          Basic Configuration<\/h2>\n
            \n
          1. Port configuration in the firewall as follows:
            \n
            \"Port
            Figure 3.2: Ports configuration in the firewall<\/figcaption><\/figure>\n<\/li>\n
          2. Set a DHCP server on interface port2 (Range of IP address should be: 192.168.1.10 to 192.168.1.20, DNS: 4.2.2.4).
            \n
            \"Set
            Figure 3.3: DHCP Server configuration<\/figcaption><\/figure>\n<\/li>\n
          3. Set port3 as a DHCP client and connect to the NAT.
            \n
            \"Set
            Figure 3.4: DHCP client configuration<\/figcaption><\/figure>\n<\/li>\n
          4. Set a static route in the firewall to reach to NAT object.
            \n
            \"Set
            Figure 3.5: Set a static route<\/figcaption><\/figure>\n<\/li>\n
          5. Go to Policy & Objects > Firewall Policy<\/strong> section, click Create New<\/strong> to add a new firewall policy, and configure the following settings:\n
              \n
            • Name: LocalToInternet<\/strong><\/li>\n
            • From inside to outside (port2 to port3)<\/strong><\/li>\n
            • Source: Create an address for the local network<\/strong> (Subnet: 192.168.1.0\/24)<\/li>\n
            • Destination: all<\/strong><\/li>\n
            • Schedule: Always<\/strong><\/li>\n
            • Service: Only HTTP, HTTPS, and DNS<\/strong><\/li>\n
            • Action: Accept<\/strong><\/li>\n<\/ul>\n
              \"Configure
              Figure 3.6: Configure Firewall Policy and enable Source NAT<\/figcaption><\/figure>\n<\/li>\n
            • Open the browser in Kali, you should be able to access the internet.
              \n
              \"you
              Figure 3.7: Verify your configuration<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n","protected":false},"author":1562,"menu_order":3,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-85","chapter","type-chapter","status-publish","hentry"],"part":77,"_links":{"self":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/85","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/users\/1562"}],"version-history":[{"count":15,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/85\/revisions"}],"predecessor-version":[{"id":1150,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/85\/revisions\/1150"}],"part":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/parts\/77"}],"metadata":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/85\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/media?parent=85"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapter-type?post=85"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/contributor?post=85"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/license?post=85"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}