# pfSense NAT - Network Address Translation and Forwarding

> Configuring NAT in pfSense - port forwarding, 1:1 NAT, outbound NAT, NAT reflection, and the order in which translations are processed.

Source: https://opennix.org/en/docs/pfsense/nat/


NAT (Network Address Translation) in pfSense handles address translation between internal and external networks. pfSense implements NAT through pf (packet filter) inherited from OpenBSD and supports three primary translation mechanisms: port forwarding, one-to-one NAT (1:1 NAT), and outbound NAT. Each mechanism addresses a distinct use case and operates at a specific stage of packet processing.

## NAT Processing Order

pfSense evaluates translation rules in a strictly defined sequence. Understanding this order is essential for correct configuration and troubleshooting.

1. **Port Forwards** - processed first. Incoming packets are checked against port forward rules, and on a match, the destination address is rewritten to the internal IP of the target host. Port forward rules take precedence over 1:1 NAT.
2. **1:1 NAT** - processed second. If no port forward rule matched, the 1:1 NAT table is consulted. On a match, the destination address is translated according to the bijective mapping between the external and internal address.
3. **Outbound NAT** - processed on egress. The source address is replaced with the address of the outgoing interface (or a designated address from a NAT pool).

> **Warning**:
>
> Port forward rules intercept inbound traffic before 1:1 NAT processing. If both a port forward and a 1:1 NAT entry exist for the same external address, the port forward takes priority for matched ports. Remaining traffic is handled by 1:1 NAT.

## Default Behavior

After installation, pfSense automatically configures outbound NAT for all internal interfaces: traffic destined for the internet is translated to the WAN interface address. Inbound traffic from the internet is blocked entirely by default - granting access to internal services requires an explicit port forward or 1:1 NAT rule.

## In This Section

- [Port Forwarding](/docs/pfsense/nat/pfsense-port-forwarding/) - redirecting inbound traffic to internal servers, firewall rule association, NAT reflection, and advanced scenarios
- [1:1 NAT](/docs/pfsense/nat/pfsense-one-to-one-nat/) - bijective translation of an external address to an internal address, use cases for servers with dedicated public IPs
- [Outbound NAT](/docs/pfsense/nat/pfsense-outbound-nat/) - controlling source address translation for egress traffic, manual and hybrid modes, static port for VPN

## Related Sections

- [pfSense Firewall](/docs/pfsense/firewall/) - filtering rules, aliases, and security policy management
- [Firewall Rules](/docs/pfsense/firewall/pfsense-firewall-rules/) - rule creation, processing order, floating rules
- [pfSense VPN](/docs/pfsense/vpn/) - VPN tunnel configuration requiring correct NAT settings