Port Forwarding/NAT Issues

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Port Forwarding/NAT Issues

L0 Member

I just set up my PA-200 and I'm trying to get my Plex server (on my LAN) to be accessible via WAN. I don't think I fully understand how NAT and security policies intertwine so I'm rather confused


I'm able to get LAN traffic outbound, but for one reason or another, I can't seem to get either my NAT or security policies correct to allow traffic in to my Plex server


I'm not sure what information to post, but I would appreciate some guidance on this


Hi @wallbert 


Creating rules and NAT for inbound traffic with Palo Alto FW can be confusing at the beginning, but everything will make sense once you understand the order of operations.


- PAN FW is dermining the destination zone using route lookup - it will check its routing table for the destination address and see which zone will be used to egress the traffic

- In general when packet hits PAN FW it will apply the following order

  1. Evaluating the NAT policies - only check if NAT is required, but without applying it
  2. Perform security rule lookup - will check if traffic is matching this traffic
  3. Apply NAT if any and forward the traffic

Each policy lookup (nat and security) is performing route lookup - the NAT rules will try to find destination zone for the public IP address (before the NAT being applied). Because your public NAT address is part of the public network assigned to the FW outside interface (or it is part of additional public range routed to your FW, which does not existing in your network) route lookup will match the default toute - FW will associate the public NAT ip with your outside zone.

Security policy lookup will again perform route lookup, but it already know that destination NAT will be applied, so it will check how NATed (private address) will be routed and use that zone as destination. But since the NAT is not yet applied, packet is still using the public IP.






Cyber Elite
Cyber Elite

Hi @wallbert ,


Here is an article with NAT and security policy examples to show you how to do it.







PS In the security policy, pre-NAT IP and post-NAT everything else.

Help the community: Like helpful comments and mark solutions.

Thank you for the detailed explanation. I've found that my Palo doesn't support uPnP, which I require for my network for gaming, so I will end up using the Palo in a lab environment instead

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!