Beginner · Setting up VyOS with NAT · section 6 of 7

Checklist and troubleshooting

✓ Lab-tested 17 October 2026 on VyOS 2026.10.16-0024-rolling

Checklist

Interfaces addressed and described; default route to the ISP.
Source NAT matches the private source range and the WAN outbound interface. Public subnets are never NATed.
masquerade for a dynamic WAN address; a fixed translation address for a static one.
Each port forward has an inbound interface, protocol and port, and a fixed address for the inside host (a DHCP reservation, or a static address).
A forward firewall with a default drop: established and related first, LANs out, destination-NAT connections, and explicit services to the public LAN.
The same forward policy for IPv6, if you have it.
The input firewall and SSH setup from the VyOS BGP lesson, so the router itself is protected too.

When it doesn't work

Symptom	Look at	Usual cause
Private hosts can't reach the internet	Capture on the WAN: is the source 10.x?	No source NAT rule, or it matches the wrong source range or interface
Public hosts appear as the WAN address	`show nat source rules`	The source NAT rule has no source match
Port forward times out from outside	`show nat destination translations`, the forward firewall counters	Wrong inbound interface or port, the inside host's own firewall, or the host's default gateway isn't R1
Port forward works from outside but not inside	Where the test came from	No hairpin NAT. Use split DNS, or add reflection rules
Something stopped working after the firewall commit	`show firewall ipv4 forward filter`: which counter is rising?	The default drop is catching it. Add an explicit rule

Also common on a small VyOS router

DHCP server on the NAT-LAN (service dhcp-server), so hosts get their address, gateway and DNS automatically.
DNS forwarding (service dns forwarding), so hosts can use R1 as their resolver.
Carrier-grade NAT (CGNAT): if your WAN address is in 100.64.0.0/10, the ISP is NATing you too, and port forwards can't work from the internet. Ask for a public address.

R1's final configuration (real output)

vyos@R1:~$ show configuration commands | match "interfaces ethernet|protocols static|nat |host-name"
set firewall ipv4 forward filter rule 40 connection-status nat 'destination'
set interfaces ethernet eth0 address '203.0.113.2/30'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth0 hw-id '52:54:00:01:00:01'
set interfaces ethernet eth1 address '10.0.0.1/24'
set interfaces ethernet eth1 description 'NAT-LAN'
set interfaces ethernet eth1 hw-id '52:54:00:01:01:01'
set interfaces ethernet eth2 address '198.51.100.1/28'
set interfaces ethernet eth2 description 'PUBLIC-LAN'
set interfaces ethernet eth2 hw-id '52:54:00:01:02:01'
set nat destination rule 100 description 'WAN port 8080 to the web server on lanhost'
set nat destination rule 100 destination port '8080'
set nat destination rule 100 inbound-interface name 'eth0'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '10.0.0.10'
set nat destination rule 100 translation port '80'
set nat source rule 100 description 'NAT-LAN to the internet via the WAN address'
set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
set system host-name 'R1'

Line 2: Matched by the filter because the line contains "nat "; the full firewall is in stage 4.
Lines 12–17: The port forward.
Lines 18–21: Source NAT for the NAT-LAN.