Properties for Network Address Translation (NAT). The entire {{object}} object only applies to IPv4. {{numentries}} {{numentries}} The maximum number of port mappings that can exist at any given time. If the value of this parameter is 0, then it means that the device doesn't have a limit to the number of port mappings that can exist. {{numentries}} The maximum number of port triggers that can exist at any given time. If the value of this parameter is 0, then it means that the device doesn't have a limit to the number of port mappings that can exist. NAT settings for an associated IP Interface on which NAT is enabled. For enabled table entries, if {{param|Interface}} is not a valid reference then the table entry is inoperable and the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Note: The {{object}} table includes a unique key parameter that is a strong reference. If a strongly referenced object is deleted, the CPE will set the referencing parameter to {{empty}}. However, doing so under these circumstances might cause the updated {{object}} row to then violate the table's unique key constraint; if this occurs, the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}} and disable the offending {{object}} row. Enables or disables the {{object}} entry, indicating if NAT is enabled for the referenced IP Interface instance. On creation, an {{object}} entry is disabled by default. The status of this entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. NAT enabled but forced by a third party to be operationally disabled, e.g. because a {{object|##.MAP.Domain}} is enabled but there is no Basic Mapping Rule {{bibref|RFC7597}}. NAT enabled but port mapping has been operationally disabled by a third party, e.g. because this is REQUIRED by the current {{object|##.Firewall}} level. {{reference}} The associated outgoing IP interface on which NAT is to be enabled. Each list item MUST be the Path name of a {{object|.IP.Interface.{i}.IPv4Address.}} table or of one of its rows. If the referenced object is deleted, the corresponding item MUST be removed from the list. Specifies the source IPv4 network(s) that MUST be translated for all outgoing traffic associated with the {{param|Interface}} (e.g. ''Device.IP.Interface.2.IPv4Address.'' (table) or ''Device.IP.Interface.2.IPv4Address.1.'' (row)). The {{param|.IP.Interface.{i}.IPv4Address.{i}.IPAddress}} and {{param|.IP.Interface.{i}.IPv4Address.{i}.SubnetMask}} are used to construct an additional filter rule that specifies which address range needs to be translated. Determines the timeout, in {{units}}, of NAT translations for TCP sessions. It is the time after which a NAT entry is removed from the NAT table if there is no activity. A value of -1 represents an infinite duration. Determines the timeout, in {{units}}, of NAT translations for UDP bindings. It is the time after which a NAT entry is removed from the NAT table if there is no activity. A value of -1 represents an infinite duration. Port mapping table. This table MUST contain all NAT port mappings associated with this connection, including static and dynamic port mappings programmatically created via local control protocol, such as UPnP. This table MUST NOT contain dynamic NAT binding entries associated with the normal operation of NAT. If the CPE hosts a firewall, it is assumed that it will appropriately configure the firewall for the port mapping. For enabled table entries, if {{param|InternalClient}} is {{empty}}, or if {{param|Interface}} is not a valid reference and {{param|AllInterfaces}} is {{false}}, then the table entry is inoperable and the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables the port mapping instance. On creation, an entry is disabled by default. The status of this entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. Indicates that the port mapping is still enabled but has been temporarily deactivated due to the Schedules defined in {{param|ScheduleRef}}. Indicates the Origin of the {{object}} instance. Note: This parameter was changed to writeOnceReadOnly in the Device:2.18 version. Used for indicating that the port mapping entry was created by the end-user. For example through the web user interface. Used for indicating that the port mapping entry was created by the system itself. Used for indicating that the port mapping entry was created by a device using UPnP-IGD. Used for indicating that the port mapping entry was created by a Controller. Note: There is no guarantee that the {{param}} value on automatically-created {{object}} instances will be retained. This is because automatically-created {{object}} instances can be transitory. {{reference}} Specifies the IP interface to which this port mapping applies. Indicates whether this port mapping applies to all IP interfaces that support port mappings. If {{true}}, the value of {{param|Interface}} is ignored since all supported IP interfaces are indicated. Determines the time to live, in {{units}}, of a port mapping lease, where "time to live" means the number of {{units}} before the port mapping expires. A value of 0 means the port mapping is static. Support for dynamic (non-static) port mappings is OPTIONAL. That is, the only value for {{param}} that MUST be supported is 0. For a dynamic (non-static) port mapping, when this parameter is read, the value represents the time remaining on the port mapping lease. That is, for a dynamic port mapping, the value counts down toward 0. When a dynamic port mapping lease expires, the CPE MUST automatically terminate that port mapping, and MUST automatically delete the corresponding {{object}} table entry. For a dynamic (non-static) port mapping, when this parameter is read, the value represents the time (in {{units}}) remaining on the port mapping lease. That is, for a dynamic port mapping, the value counts down toward 0. When a dynamic port mapping lease expires, the device MUST automatically terminate that port mapping, and MUST automatically delete the corresponding {{object}} table entry. For a static port mapping, this parameter is irrelevant and should return ''0''. This parameter is the IP address of the source of inbound packets. {{empty}} indicates a "wildcard", i.e. any IP address (this will be {{empty}} in most cases). CPE are REQUIRED only to support {{empty}}. When {{param}} is {{empty}}, all traffic sent to the {{param|ExternalPort}} on the WAN interface of the gateway is forwarded to the {{object|##.IP.Interface}} associated with the {{param|InternalClient}} on the {{param|InternalPort}}. When {{param}} is specified as one external IP address, the NAT will only forward inbound packets from this {{param}} to the {{param|InternalClient}}, all other packets will be dropped. If a CPE supports non-empty values for {{param}}, it MAY additionally support the ability to have more than one port mapping with the same {{param|ExternalPort}} and {{param|Protocol}}, but with differing values of {{param}}. When wildcard values are used for {{param}} and/or {{param|ExternalPort}}, the following precedence order applies (with the highest precedence listed first): # Explicit {{param}}, explicit {{param|ExternalPort}} # Explicit {{param}}, zero {{param|ExternalPort}} # Empty {{param}}, explicit {{param|ExternalPort}} # Empty {{param}}, zero {{param|ExternalPort}} If an incoming packet matches the criteria associated with more than one entry in this table, the CPE MUST apply the port mapping associated with the highest precedence entry. The external port (or the first port of a range of external ports) that the NAT gateway would listen on for traffic to a corresponding {{param|InternalPort}}. Inbound packets to this external port on the WAN interface SHOULD be forwarded to the {{object|##.IP.Interface}} associated with the {{param|InternalClient}} on the {{param|InternalPort}}. A value of zero ({{null}}) represents a "wildcard", i.e. any port number. If this value is {{null}}, traffic on all external ports (that are not otherwise mapped) will be forwarded to {{param|InternalClient}}, and the value(s) of {{param|InternalPort}} on {{param|InternalClient}} are ignored. When wildcard values are used for {{param|RemoteHost}} and/or {{param}}, the following precedence order applies (with the highest precedence listed first): # Explicit {{param|RemoteHost}}, explicit {{param}} # Explicit {{param|RemoteHost}}, zero {{param}} # Empty {{param|RemoteHost}}, explicit {{param}} # Empty {{param|RemoteHost}}, zero {{param}} If an incoming packet matches the criteria associated with more than one entry in this table, the CPE MUST apply the port mapping associated with the highest precedence entry. Indicates the last port of the external port range that starts with {{param|ExternalPort}}. If an external port range is specified, then the behavior described for {{param|ExternalPort}} applies to all ports within the range. A value of zero (0) indicates that no external port range is specified, i.e. that the range consists only of {{param|ExternalPort}}. If {{param|ExternalPort}} is zero (wildcard), the value of this parameter MUST be ignored. If specified, the value of this parameter MUST be greater than or equal to the value of {{param|ExternalPort}}. The port on {{param|InternalClient}} that the gateway SHOULD forward traffic to. When {{param|ExternalPortEndRange}} is utilized, this range will also be applied accordingly, starting from the {{param}} number. The protocol of the port mapping. {{enum}} The IP address or DNS host name of an internal client (on the LAN). Support for an IP address is mandatory. If {{param}} is specified as an IP address and the LAN device's IP address subsequently changes, the port mapping MUST remain associated with the original IP address. Support for DNS host names is OPTIONAL. If {{param}} is specified as a DNS host name and the LAN device's IP address subsequently changes, the port mapping MUST remain associated with this LAN device. In this case, it is the responsibility of the CPE to maintain the name-to-address mapping in the event of IP address changes. This can be accomplished, for example, by assigning the DNS host name via use of DHCP option 12 (Host Name) or option 81 (FQDN). Note that the Controller can learn the host name associated with a given LAN device via the {{object|##.Hosts.Host}} table. Read access to this parameter MUST always return the exact value that was last set by the Controller. For example, if the internal client is set to a DNS host name, it MUST read back as a DNS host name and not as an IP address. It MUST be possible to set the {{param}} to the broadcast IP address 255.255.255.255 for UDP mappings. This is to enable multiple NAT clients to use the same well-known port simultaneously. User-readable description of this port mapping. Firewall PortTrigger table. Enables or disables the Port Trigger The status of this {{object}} entry. Indicates that the PortTrigger entry is disabled. Indicates that the PortTrigger entry is enabled. Indicates that the PortTrigger is still enabled but has been temporary deactivated due to the Schedules defined in {{param|ScheduleRef}}. Indicates that a necessary configuration value is undefined or invalid. MAY be used to define an error condition. Indicates the owner of the {{object}} instance. Note: This parameter was changed to writeOnceReadOnly in the Device:2.18 version. Used for indicating that the PortTrigger entry was created by the end-user. For example through the web user interface. Used for indicating that the PortTrigger entry was created by the system itself. Used for indicating that the PortTrigger entry was created by a Controller. Human-readable description associated with this {{object}} entry. Specifies the incoming L3 interface to which this port trigger applies. Typically this will be the LAN interface. Trigger Port, the port number which is used to start the port trigger rule. Indicates the last port of the port range that starts with {{param|Port}} which is used to start the port trigger rule. A value of zero (0) indicates that no port range is specified, i.e. that the range consists only of {{param|Port}}. If {{param|Port}} is zero, the value of this parameter MUST be ignored. If specified, the value of this parameter MUST be greater than or equal to the value of {{param|Port}}. Number of {{units}} the port trigger MUST be active. When the {{param}} is expired new connections are no longer allowed, active connections SHOULD not be terminated. Indicates when the port trigger was enabled. When the port trigger is no longer active. Note: This parameter was demoted to readOnly in the Device:2.18 version. The protocol of the trigger port. {{numentries}} Firewall PortTrigger Rule table. Port (or the first port of a range of ports) which needs to be opened when the Trigger conditions are met. Indicates the last port of the port range that starts with {{param|Port}} which needs to be opened when the Trigger conditions are met. A value of zero (0) indicates that no port range is specified, i.e. that the range consists only of {{param|Port}}. If {{param|Port}} is zero, the value of this parameter MUST be ignored. If specified, the value of this parameter MUST be greater than or equal to the value of {{param|Port}}. The protocol of the to be forwarded port.