--- title: "Configure private NAT rules" canonical: "https://docs.aryaka.com/space/KNOW/532021273/Configure%20private%20NAT%20rules" format: markdown --- The Sites > Site: page enables you to configure private network address translation (NAT) rules for selected sites. These rules are used when a LAN-side IP (typically a private IP) or an entire subnet needs to have its network address translated to another private IP or a new subnet before sending traffic to a remote site. When you configure a private NAT rule, you must specify whether the rule applies to inbound, outbound, or bidirectional matched traffic. Based on the direction selected, you can then choose the type of translation to perform on matched traffic—static source NAT (SNAT), static destination NAT (DNAT), port address translation (PAT), or skip NAT. SNAT and DNAT translate source and destination IP addresses, respectively, into unique IP addresses to be used publicly. PAT translates all private IP addresses in a subnet to a single public IP address. Private NAT rules use 5-tuple match criteria (source IP (SIP), destination IP (DIP), source port, destination port, and protocol) to identify traffic and perform the configured address translation. For additional details about this feature, see the Private NAT topic. Follow the procedures in this topic to view, add, or edit private NAT rules. To view private NAT rules Log in to MyAryaka. The Home page appears. Click Sites in the left navigation pane. The Sites page appears. It lists all existing sites. Click the name of the site for which you want to configure private NAT rules. The selected site's page appears. Click the NAT section to expand it. The Private NAT tile appears. Click View on the Private NAT tile. The Private NAT page appears in read-only mode and displays a table with the following columns: Rule ID—Automatically-assigned identification number for the rule. Name—Name of the configured rule. This column also displays whether the rule is currently enabled or disabled. Inbound NAT—Configured inbound network address translation type for the rule. Options include Static SNAT, Static DNAT, PAT, Skip SNAT, and Skip DNAT. Outbound NAT—Configured outbound network address translation type for the rule. Options include Static SNAT, Static DNAT, PAT, Skip SNAT, and Skip DNAT. Original SIPS—Source IP addresses before network address translation is applied. Original DIPS—Destination IP addresses before network address translation is applied. Natted SIPS—Source IP addresses after network address translation is applied. Natted DIPS—Destination IP addresses after network address translation is applied. (Optional) Click the Detailed View toggle to view all configured values for the columns. If a rule includes more than four IP addresses or ports for a given field, only the first four values are displayed by default. (Optional) Click the Gear icon to add the following columns to the table: Original source port—Source port before network address translation is applied. Original destination port—Destination port before network address translation is applied. To add private NAT rules Open the Private NAT page if it is not already open: Log in to MyAryaka. The Home page appears. Click Sites in the left navigation pane. The Sites page appears. It lists all existing sites. Click the name of the site for which you want to configure private NAT rules. The selected site's page appears. Click the NAT section to expand it. The Private NAT tile appears. Click View on the Private NAT tile. The Private NAT page appears in read-only mode. Click the Edit icon. The Private NAT page appears in edit mode. Click Add . The Private NAT page displays the Basic Details, Original Packet Identifier, and Natted SIP panes. In the Basic Details pane, enter a name for your rule in the Rule Name field. (Optional) Enter a description for your rule in the Description field. Click the Direction drop-down list and select one of the following options: Bidirectional—Rule applies to any traffic arriving at or leaving the selected site. Inbound—Rule applies to traffic arriving at the selected site. Outbound—Rule applies to traffic leaving the selected site. Click the NAT Type drop-down list and select one of the following options: Note: The exact name of this field and the available drop-down list options depend on your selection in step 6. Static SNAT—Static source NAT translates each specified source IP to a unique IP address. Static DNAT—Static destination NAT translates each specified destination IP to a unique IP address. PAT—Port address translation translates all specified source IP addresses and source ports to one IP address or one IP address range. Skip SNAT—Source NAT is not applied to the specified IP addresses. This is often used for testing. Skip DNAT—Destination NAT is not applied to the specified IP addresses. This is often used for testing. In the Original Packet Identifier pane, complete the following procedure for each of the attributes you want to include in the rule: Note: The attribute that is most relevant to the option selected in step 7 is shown by default. To view and add additional attributes, click Advanced . Click the Add icon. The Add < attribute > dialog appears. Depending on the type of attribute selected, do one of the following: Enter one or more entities you want to include as match criteria for the rule. Click one or more entities you want to include as match criteria for the rule. The selected entities are highlighted in green and display a check. Click Add Selected . The Private NAT page displays the selected entities for each attribute. In the Natted SIP pane (if you selected a DNAT option in step 7, this pane is called Natted DIP), enter the IP addresses that you want to be applied during network address translation. You must enter the addresses as a range (for example, 10.10.10.0-10.10.10.8). If you selected Static SNAT or Static DNAT in sep 7, the range must include at least as many IP addresses as specified by the attributes you configured in step 8. Click Continue . The Private NAT page displays your configured rule in the Private NAT table. (Optional) Repeat steps 3–10 to configure another private NAT rule. (Optional) Reorder the rules in the table. Click the Reposition icon next to the rule you want to move and drag it to a new position in the table. Note: Rules are evaluated in a top-down manner based on the Private NAT table. However, all DNAT rules are evaluated before SNAT rules are evaluated, regardless of their position in the table. Do one of the following: Click Save as Draft to save a draft of the rule. Click Submit to save the rule. You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the Private NAT page displays your new rule in the list of private NAT rules. To edit private NAT rules Open the Private NAT page if it is not already open: Log in to MyAryaka. The Home page appears. Click Sites in the left navigation pane. The Sites page appears. It lists all existing sites. Click the name of the site for which you want to configure private NAT rules. The selected site's page appears. Click the NAT section to expand it. The Private NAT tile appears. Click View on the Private NAT tile. The Private NAT page appears in read-only mode. Click the Edit icon. The Private NAT page appears in edit mode. Edit the configured private NAT rules as needed. The following changes can be made to private NAT rules: Reorder the rule list—Click the Reposition icon next to the rule you want to move and drag it to a new position in the table. Add a new rule—Click Add and complete steps 3–10 of the Add a private NAT rule procedure. Edit a rule—Click the following icons in the Actions column of the rule you want to edit: Edit—Displays the rule in edit mode. Modify the rule as needed. See steps 4–10 of the Add a Private NAT rule procedure for details on configuration options. Enable/Disable—Renders the rule active or inactive. If you disable a rule it is not removed from the table and can be enabled again later. Clone—Adds a new rule with the same configuration as the cloned rule. The new rule is added to the table directly after the rule it was cloned from. Edit the cloned rule as needed. Add Below—Adds a new blank rule below the selected rule. Delete—Removes the rule from the table. Do one of the following: Click Save as Draft to save a draft of the edited rule. Click Submit to save the rule. You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the Private NAT page displays your new rule in the list of private NAT rules. Related topics View and edit site configuration Configure a site Internet NAT Private NAT