---
title: "Creating DNAT Rules"
slug: "fortigate-creating-dnat-rules"
updated: 2026-07-13T03:02:43Z
published: 2026-07-13T03:02:43Z
canonical: "docs.serversaustralia.com.au/fortigate-creating-dnat-rules"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serversaustralia.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating DNAT Rules

ImportantOn your Firewall's primary IP address (the /31 assigned to your VDOM link interface), port 20443 is used for the HTTPS VDOM user interface. As such, if you NAT port 20443 you will lose access to the WebUI.  
  
Please make sure you do not NAT Port 20443 on the Primary IP Address.

When creating a Destination NAT rule (DNAT), you first need to create a **'Virtual IP'**. This is a mapping of Public IP to Private IP.

Virtual IP's can be in either 1 to 1 mapping (Public to Private), or 1 to Many (Port Forwarding) configurations.

In a port forwarding configuration, you can use a single public IP address to give access to multiple private IP addresses, on different ports. This saves you from having to purchase multiple IP addresses in many cases (such as if you run a hypervisor).

## Examples

**Below is a simple example of 1:1 NAT:**

27.50.127.2 -> 192.160.0.2

*In 1:1 NAT, the Firewall policy is used to only allow access to specific ports.*

**Below is a simple example of 'Port Forwarding':**

27.50.123.2:3389 -> 192.168.0.2:3389 27.50.123.2:3390 -> 192.168.0.100:3389 27.50.123.2:3391 -> 192.168.0.250:3389

*Notice how the Public IP Address remains the same and we're simply specifying Ports, whilst on the 'Private' side each destination is unique.*

## Configuring Virtual IPs

In this example, we have a Public IP Address of **27.50.123.2**, which is part of one of our existing IP pools. We also have a server behind our firewall on a private IP address **192.168.0.2.**

The goal of this example DNAT rule is to allow our users to connect Remote Desktop (RDP) on **192.168.0.2** via the Public IP Address **27.50.123.2** on a Custom RDP port **29292**.

The final NAT rule will visually look like this:

**27.50.123.2:29292 ->** **192.168.0.2:3389**

In other words, when a user enters **"****27.50.123.2:29292"** into their RDP client, it will forward the connection to **192.168.0.2:3389**, allowing the user to connect to the default RDP port (3389) on our server's private IP (192.168.0.2).

## How to create a new Virtual IP

1. Log into your Fortigate Firewall with the credentials you've been supplied:![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/fortigate%20login%20box%20defaulttheme.jpg)

2. Navigate to **'Policy & Objects'**, then **' DNAT &** **Virtual IPs'** , then under the **'Virtual IP'** tab click **'+ Create New'** ![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/Screenshot%202026-06-24%20at%202.35.26%E2%80%AFpm.jpg)

We can then proceed on to configuring below.

### How to Configure the Virtual IP

Please refer to the below image in reference to the corresponding numbered instructions:

1. Enter a name for your Virtual IP (DNAT) policy. Make it as descriptive as possible so you can easily identify it later.
2. Enter the external IP address. This is the IP which external/internet users will access.
3. Enter the internal/private IP address which is the final destination of the traffic.
4. If you're doing Port Forwarding (not 1:1 NAT), tick **Port Forwarding**, and then choose the Protocol of the ports you wish to forward.
5. Choose the Port of the external IP Address. In this example we're translating **Port 29292 to Port 3389** so we want 29292 on the Public/External side.
6. Set the Port which the service is listening on, on the private IP address. In this example we're trying to provide access to Remote Desktop (RDP) which listens on port 3389 by default.
7. Click **OK** once you've completed the configuration.![](https://cdn.document360.io/d809f158-d4f4-47ff-83d4-18d9c9f7a04d/Images/Documentation/image-1684293860729.png)

Once complete, proceed to Firewall Policy section to configure ALLOW rules!

By default, all incoming traffic is denied, so you won't be able to access the services on the Virtual IP address until you create specific Firewall Policies for it!

#### [Click HERE to proceed to the Firewall Policy guide.](https://docs.serversaustralia.com.au/docs/fortigate-create-firewall-policies)