How to Configure NAT with Windows Server RRAS
Applies to: Windows Server 2019, 2022 and 2025.
RRAS NAT translates private client addresses through an external interface. It must not accidentally publish management services or overlap existing edge-firewall NAT.
Network changes can immediately interrupt management access. Maintain console access, export the current configuration and use approved test addresses. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Identify private and public adapters by MAC and IP.
- Confirm the server is intended to be a router.
- Enable IP forwarding only through the approved design.
- Record current routes and firewall policy.
Procedure
Step 1: Install routing role
Add RRAS routing tools.
Install-WindowsFeature RemoteAccess,Routing -IncludeManagementToolsStep 2: Enable RRAS custom routing
In rrasmgmt.msc choose Configure and Enable Routing and Remote Access, then Custom configuration and LAN routing.
Step 3: Add NAT protocol
Under IPv4, add NAT.
Step 4: Assign interfaces
Mark the internet-facing adapter Public and enable NAT; mark the internal adapter Private.
Step 5: Review firewall exposure
Create only required inbound mappings and avoid exposing RDP.
Step 6: Test client egress
Verify private clients retain correct DNS and default gateway.
Verification
Confirm forwarding path, routes and translated client connectivity.
Get-NetIPInterface | Select InterfaceAlias,AddressFamily,Forwarding
Get-NetRoute -AddressFamily IPv4
Test-NetConnection networkmanager.info -Port 443Rollback
Remove NAT interface configuration and disable RRAS custom routing from console, then restore the recorded gateway and routes.
Security and operational notes
In hosted environments, provider or perimeter firewall NAT is often preferable to a Windows server acting as the internet edge.
