NAT Gateway

Navigation: Scenarios → NAT Gateway

Deploy the TOORCE Firewall as a NAT gateway between your internal LAN and the internet. LAN hosts use private addresses (192.168.100.0/24); outbound connections are translated to the WAN interface public IP using Source NAT (SNAT).

Network design

The diagram below shows a typical deployment: LAN clients behind enp6s0, a single WAN uplink on enp9s0, a default route to the ISP gateway, and an inline rule that performs SNAT using the outgoing interface address.

Figure 1 — NAT gateway topology (reference design)

Addressing summary

Prerequisites

• Physical cables: ISP/router → WAN port, LAN switch → LAN port
• Admin access to the TOORCE web panel (https://<firewall-ip>:10443)
• Optional: create a LAN_Network address object for cleaner rules

Step 1 — Configure the LAN interface

1. Go to Network Settings → Interfaces.
2. Click Edit on the LAN interface (enp6s0).
3. On the General tab:

4. Open the Addressing tab:

5. (Recommended) On the DHCP Server tab, enable DHCP for LAN clients:

6. On Admin Access, enable HTTPS for management from the LAN only.
7. Click Save.

See Network Interfaces for full field reference.

Step 2 — Configure the WAN interface

1. Go to Network Settings → Interfaces.
2. Click Edit on the WAN interface (enp9s0).
3. On the General tab:

4. On the Addressing tab, choose one:

5. Disable HTTP/HTTPS/SSH admin access on WAN (security best practice).
6. Click Save.

Step 3 — Add the default route

The firewall needs a route to 0.0.0.0/0 so traffic destined for the internet is forwarded out the WAN interface.

1. Go to Network Settings → Static Routs.
2. Click + Add New.
3. Enter:

4. Click + Create Record.

If WAN uses DHCP, the ISP gateway is often learned automatically — add this static route only if required in your environment. See Static Routes.

Step 4 — Create an inline rule with SNAT

This rule allows LAN → internet traffic and applies Source NAT using the WAN interface address.

1. Go to Rules & Policies → Inline Rules.
2. Click + Add New.

General tab

Interfaces tab

Source tab

Destination tab

NAT/SDWAN tab

This setting rewrites the source IP of outbound packets from 192.168.100.x to the WAN IP (203.0.113.50), so return traffic from the internet can reach the firewall and be forwarded back to the correct LAN host (stateful inspection).

3. Click + Create Record.
4. Click Install Policy to apply rules to the running firewall.

Full rule field reference: Inline Rules

Step 5 — Verify connectivity

Recommended rule order

Place the NAT allow rule above implicit deny but below any specific deny rules:

Security notes

• Do not expose the admin UI on the WAN interface.
• Add IPS and Web Security profiles to the rule for NGFW protection.
• Restrict outbound access with port objects if full internet access is not required.

Related topics

• Network Interfaces
• Static Routes
• Inline Rules
• Address Objects
• Firewall Security Logs
• All Scenarios