Sophos training helps network and security professionals understand how firewalls control traffic, protect internal resources, and connect private networks to the internet. Two of the most important concepts to learn are Network Address Translation (NAT) and firewall rules. NAT determines how IP addresses and ports are translated as traffic moves between networks, while firewall rules decide whether that traffic should be allowed or blocked.
In a Sophos Firewall environment, understanding how these two features work together is essential for tasks such as providing internet access to users, publishing internal servers, creating secure remote access, and controlling application traffic.
Network Address Translation changes the source or destination address of network packets as they pass through the firewall. A common example is a private device accessing the internet through a public IP address.
Sophos Firewall supports different NAT scenarios, including source NAT and destination NAT. Source NAT is commonly used when internal users access external networks, while destination NAT is typically used when an internet-based user needs to reach an internal service.
For example, suppose an internal web server uses 192.168.10.20, but internet users need to access it through the organization's public IP. A DNAT rule can translate the public destination address to the internal server.
| NAT Type | Common Purpose | Example |
|---|---|---|
| Source NAT | Internal users accessing external networks | LAN to Internet |
| Destination NAT | Publishing an internal service | Public IP to Web Server |
| SNAT with Masquerading | Sharing a WAN IP | Multiple users using one public IP |
| Port Translation | Redirecting traffic between ports | Public TCP 443 to internal TCP 443 |
The exact configuration depends on the network topology and the service being published.
Before creating NAT or firewall rules, define the networks, hosts, and services involved. In Sophos Firewall, these objects make rules easier to understand and maintain.
For example, you may create:
Using meaningful names such as LAN_Network, Web_Server, and HTTPS_Service makes troubleshooting much easier later.
A typical internal-to-internet setup requires source NAT so that private addresses can communicate through the public WAN address.