Scheduled maintenance: Community available only in read-only mode until 6:00 AM (PT)
New Member
Posts: 3
Registered: ‎07-27-2018

NAT IP protocols

Hi, I'm using the USG as a gateway in my house and I would like to NAT a specific IP protocol over my homelab. When creating the NAT via the GUI or via SSH, I can only select TCP or UDP as transport protocol. I can create Firewall rules with IP protocol but not NAT rules. Is there another way?

 

The reasoning behind is to route protocol 41 (IPv6 over IPv4 encapsulation) from a tunnel broker on the Internet. But it is valid for other IP protocols (e.g. IP-over-IP, GRE, IPSEC AH/ESP, etc.).

Senior Member
Posts: 3,163
Registered: ‎01-29-2015
Kudos: 523
Solutions: 131

Re: NAT IP protocols

Create a port forward, you can specify the port number there. Once you are finished, it will automatically create the firewall rule for you.

 

Port forward on the USG is what NAT is on other firewalls.

Established Member
Posts: 866
Registered: ‎09-01-2014
Kudos: 397
Solutions: 52

Re: NAT IP protocols

It does seem something of an oversight - there's no way in the gui to do this (despite, as you say, it being possible for firewall rules).

 

EdgeOS (to which USGs are very similar under the hood) allows protocol numbers so there's every reason to think you can achieve what you want to do, but it'd involve making a json config file on the controller.

 

I'd start by making a dummy rule with UDP and a recognisable name, export the config, look for your rule and edit the protocol number. From that you'd need to create the json file - it's a long time since I last did that but there are guides around this forum.

If you found this post helpful feel free to sprinkle some Kudos!
New Member
Posts: 3
Registered: ‎07-27-2018

Re: NAT IP protocols

Thanks for the reply. The problem is that I need to forward an IP protocol and not a TCP/UDP port. I can create the firewall rule but not a NAT rule. It is a pretty edgy case Man Happy

New Member
Posts: 3
Registered: ‎07-27-2018

Re: NAT IP protocols

Thanks, I'll give it a try on exporting the config. A bit afraid of breaking my USG in the other hand Man Happy

Highlighted
Established Member
Posts: 866
Registered: ‎09-01-2014
Kudos: 397
Solutions: 52

Re: NAT IP protocols


@silviogissi wrote:

Thanks, I'll give it a try on exporting the config. A bit afraid of breaking my USG in the other hand Man Happy


Once you've generated your json file make sure to run it through a sanity checker - there are various online utilities available to do this. You do run the risk of falling into reboot loops if the USG chokes, so best to be safe...

If you found this post helpful feel free to sprinkle some Kudos!