When you run services in a private network behind an SAG device, external clients on the Internet cannot reach those services directly. Destination Network Address Translation (DNAT) solves this by mapping the private IP address of your SAG device to a public IP address, so that inbound traffic is redirected to the correct internal host.
Prerequisites
Before you begin, ensure that you have:
An SAG instance in the Smart Access Gateway console
Confirmed whether you need full IP mapping (all ports) or port-level forwarding (specified port)
Add a DNAT rule
Log on to the Smart Access Gateway console.
Open the Network Configuration tab for your SAG instance using either method:
Click the SAG instance ID, then click the Network Configuration tab on the details page.
Find the SAG instance and click Network Configuration in the Actions column.
Click the DNAT tab, then click Add DNAT Rule.
In the Add DNAT Rule dialog box, configure the parameters and click OK.
Parameters
DNAT type
Choose the DNAT type based on your scenario:
| Type | When to use |
|---|---|
| Public Network DNAT | Your clients connect over the Internet. Maps a private IP address to a public IP address and automatically detects the current public IP. |
| Private Network DNAT | You need to hide the private IP address from Alibaba Cloud, CIDR blocks overlap in your private network, or you use SNAT to access Alibaba Cloud resources and also need to reach private networks over the Internet. Maps a private IP address to a specified private IP address. The target private IP address must not overlap with any other IP address in the private network. |
Connection type
| Type | Behavior |
|---|---|
| All ports | Uses IP mapping. All traffic destined for the public IP address is forwarded to the mapped private IP address. |
| Specified Port | Forwards traffic matching a specific protocol and port. Enter the public port, private port, and protocol based on your workload. |
Other parameters
| Parameter | Description |
|---|---|
| Public IP | The CIDR blocks before translation based on the DNAT rule — the public-facing address that incoming traffic targets. |
| Private IP | The CIDR block after translation based on the DNAT rule — the internal target in your private network. |
| Public Port | The port after translation based on the DNAT rule. Valid values: 1–65535. Only applies to Specified Port connection type. |
| Private Port | The port before translation based on the DNAT rule. Valid values: 1–65535. Only applies to Specified Port connection type. |
| Protocol | The protocol to match. See the SAG console for supported options. |