Oracle Cloud Infrastructure Documentation

Add a NAT Rule to a Firewall Policy

NAT rules contain a set of criteria against which a network packet is matched for source address translation (NAT).

Before you can create a NAT rule, create address lists to use them as a matching criteria while defining the NAT rule.
Note

If no match criteria are defined in a NAT rule (or if an empty address list is specified for the rule), the rule matches to "wildcard" (any criteria). This behavior applies to all traffic examined in the rule.

    1. Open the navigation menu, and select Identity & Security. Under Firewalls, select Network Firewall policies.
    2. Select the compartment that contains the firewall policy that you want to add a NAT rule to.
    3. Select the firewall policy.
    4. On the details page, select the Rules tab.
    5. From within the NAT rules table, select Create NAT rule.
    6. In the Name field, enter a name for the rule. Avoid entering confidential information.
    7. (Optional) In the Description field, enter a brief summary of the NAT rule.
      Use this field to provide details about the NAT rule to help other users understand its purpose or configuration. You can enter up to 1,000 characters and can edit this field at any time.
    8. Under Match condition, specify the source and destination addresses that must match for the NAT rule to apply.
      • Under Source addresses:
        • Select Any source address matches the rule if the rule applies to traffic from any source address.
        • Select Create or select a list of source addresses to match the rule to apply the rule only to traffic from specific source addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
      • Under Destination addresses:
        • Select Any destination address matches the rule if the rule applies to traffic from any destination address.
        • Select Create or select a list of destination addresses to match the rule to apply the rule only to traffic from specific destination addresses, then select an existing address list or create a new one by selecting Create address list from the Actions menu. To learn how to create an address list, see Create an Address List.
    9. Under Rule translation, review the NAT type and Translation type. These values are automatically set in the Console.
    10. Under Rule order, select the position of the rule in relation to other NAT rules in the policy. The firewall applies the NAT rules in the specified order from first to last.
      • Select First rule in list to evaluate this rule before the existing NAT rules.
      • Select Last rule in list to evaluate this rule after the existing NAT rules.
      Note

      Custom position is enabled only if you create more than one NAT rule. If you select it, specify whether you want this rule to come before an existing rule or after an existing rule. Then, specify the rule that you want the new rule to come before or after.
    11. Select Create.

    To delete a NAT rule from a firewall policy, see Delete a Rule from a Firewall Policy.

  • Use the network-firewall nat-rule create command and required parameters to create a NAT rule:

    oci network-firewall nat-rule create --name my_nat_rule --network-firewall-policy-id network firewall policy OCID 
--type NATV4  ...[OPTIONS]

    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.

  • Run the CreateNatRule operation to create a NAT rule.