One-to-one NAT
So far, we have learned about NAT types that allow us to map one-to-many IP addresses, so the main difference of this type of NAT is that it will map one IP to another one in a one-to-one manner. Every port will be forwarded to the internal IP or network, and if all traffic is permitted by the filter rule, this can mean an internal IP is exposed to the internet, so be careful using this type of NAT.
In my personal experience, I have seen a few instances of OPNsense using NAT one to one in corporate networks. A common situation I will mention is when you need to connect two remote sites using an IPsec tunnel and the internal networks overlap between those sites. In this case, one-to-one BINAT usually helps a lot!
Next, we'll see how to add a one-to-one rule.
Adding a one-to-one NAT rule
To add a rule, go to Firewall | NAT | One-to-One and click on the + Add button. A new page will be opened with the following options:
- Disabled: Check this option...