Arrange the basic logic for an external user to reach an internal server through destination Network Address Translation (NAT).

### The order 1. **The connection reaches the firewall's public-facing address and port**: the external user initially addresses the public endpoint. 2. **The public destination and port are mapped to the private server destination and port**: destination NAT redirects the connection toward the internal server. 3. **The firewall evaluates the security policy for the traffic**: translation does not itself authorize the connection, so policy must allow it. ### The concept Destination NAT is commonly used for port forwarding. It changes the destination information so a public endpoint can direct traffic to a private server. A firewall rule still controls whether that traffic is permitted. ### Terms - **NAT**: Network Address Translation. A method of changing network addresses. - **Port forwarding**: Mapping an external address and port to an internal address and port. ### Remember Translation selects a destination; policy decides whether traffic may pass.