Add a DNAT rule

Procedure

1. Log on to the Smart Access Gateway console.

2. Navigate to the Network Configuration page by using one of the following methods:

   • Click the ID of the target Smart Access Gateway instance to open the instance details page, and then click Network Configuration.

   • In the Operation column of the target Smart Access Gateway instance, click Network Configuration.

3. Click the DNAT tab.

4. Click Add DNAT Rule.

5. In the Add DNAT Rule dialog box, configure the mapping rule, and then click OK.

   The following table describes the parameters for a DNAT rule.

   Parameter	Description
   DNAT Type	The DNAT type. Valid values are: Public network DNAT: Maps a private IP address to a public IP address. The SAG instance automatically detects the public IP address. Select this option to allow users to access your internal services from the internet. Private network DNAT: Maps an internal private IP address to a specified private IP address. The specified private IP address must not conflict with any other IP addresses in the network. Select this option in the following scenarios: to resolve IP address conflicts when the CIDR blocks of on-premises branches overlap, to enable access from Alibaba Cloud to your on-premises network when you are already using SNAT to access Alibaba Cloud resources, or to mask the actual private IP addresses of your on-premises services from Alibaba Cloud.
   Connection Type	The mapping method for the DNAT rule. Valid options are: All Ports: This option creates an IP mapping. All traffic sent to the public IP address is forwarded to the mapped private IP address. Specified port: This option forwards traffic that matches a specific protocol and port. The SAG instance forwards traffic from the public IP address and port to the specified private IP address and port. If you select this option, you must specify the public port (the external-facing service port), private port (the port on which the internal service listens), and protocol based on your service requirements.
   Public IP	The public IP address that receives incoming traffic. This is the destination IP address before DNAT translation.
   Private IP	The private IP address of the destination server. This is the destination IP address after DNAT translation.
   Public Port	The external-facing service port. The value ranges from 1 to 65535.
   Private Port	The listening port of the internal service. The value ranges from 1 to 65535.
   Protocol	The protocol of the traffic to be forwarded. For a list of supported protocols, see the options on the Smart Access Gateway console.