The design
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
By the end you will be able to:
- Explain when a network needs NAT and when it should simply route public addresses
- Configure VyOS interfaces and a default route, and show why private sources fail without NAT
- Configure source NAT for a private LAN only, and recognise the missing-source-match mistake
- Publish a private service with destination NAT, and explain why it fails from inside
- Protect both LANs with a forward firewall, because NAT isn't one
Prerequisites: Linux Network Connectivity
A typical small-business or branch connection gives you two kinds of address space, and this lesson's router, R1, uses both:
- One public address on the WAN link (203.0.113.2), and behind it a private network (10.0.0.0/24) for staff laptops, printers and anything else that only needs to reach out. Private addresses (RFC 1918) aren't routed on the internet, so R1 uses Network Address Translation (NAT): it rewrites the source of every outgoing packet to its WAN address, and reverses the change on the replies.
- A small routed public block (198.51.100.0/28) that the ISP routes to R1's WAN address. Servers on this "public LAN" have real addresses, so they need no NAT at all: they're reachable directly, and they appear on the internet as themselves.
So R1 has three interfaces: WAN (eth0), NAT-LAN (eth1) and PUBLIC-LAN (eth2).
Two NAT features cover almost every small network:
| Source NAT (SNAT) | Destination NAT (DNAT) | |
|---|---|---|
| Rewrites | The source of outgoing packets | The destination of incoming packets |
| Used for | Letting private hosts reach the internet | Port forwarding: publishing one private service on the WAN address |
| In this lesson | NAT-LAN → WAN address, with masquerade | WAN port 8080 → 10.0.0.10 port 80 |
The lab is VyOS (rolling 2026.10.16) as a virtual machine, plus Linux containers for the ISP router, a server "on the internet" at 192.0.2.10 (it logs the source address of every visitor), and one host on each LAN. Every output is copied from that lab.
- The public LAN just routes. The ISP routes 198.51.100.0/28 to R1, so pubhost reaches the server as itself, and replies come straight back. No NAT.
- Without NAT, private sources can't get replies. lanhost's request reaches the server with source 10.0.0.10. The reply goes to the ISP, which has no route to a private network and drops it.
- Source NAT. R1 rewrites the source to its WAN address on the way out and remembers the mapping, so it can rewrite the reply back to 10.0.0.10.
- Destination NAT (port forward). Connections to 203.0.113.2 port 8080 are rewritten to 10.0.0.10 port 80. The web server still sees the real client address.
- The forward firewall. Both LANs may go out; from outside, only port forwards and web traffic to the public LAN get in. Everything else, such as the database on pubhost, is dropped at R1.
Check your understanding
Your ISP routes a public /28 to your router. Should hosts on it be NATed to the WAN address?
- Yes, NAT everything for safety
- No; they have routable addresses, so route them and protect them with a firewall
- Only if they run servers
- Only for IPv6