How to Configure Windows Server as a NAT Router Using RRAS

Network Address Translation (NAT) allows multiple devices on a private, internal network to share a single public IP address to access the internet. While hardware firewalls usually handle this, there are scenarios—such as lab environments, hyper-v host networks, or specialized branch office setups—where you need a Windows Server to act as the primary NAT router. This is accomplished using the Routing and Remote Access Service (RRAS) role.

Prerequisites

To function as a NAT router, your Windows Server must have at least two network adapters (NICs):

• External (WAN): Connected to the internet (typically receiving an IP via DHCP from your ISP).
• Internal (LAN): Connected to your private network switches (must have a static IP address, e.g., 192.168.100.1).

Step 1: Install the RRAS Role

1. Open the Server Manager.
2. Click Add roles and features.
3. Proceed through the wizard until you reach the Server Roles page.
4. Check the box for Remote Access.
5. On the Role Services page, check the box for Routing. (This will automatically check DirectAccess and VPN, which is fine).
6. Complete the wizard and click Install.

Step 2: Configure and Enable RRAS

1. Once the installation completes, open the Start menu, type Routing and Remote Access, and open the management console.
2. Right-click your server’s name in the left pane and select Configure and Enable Routing and Remote Access.
3. The configuration wizard will open. Click Next.
4. On the Configuration page, select Network address translation (NAT) and click Next.
5. On the NAT Internet Connection page, select the network interface that represents your External (WAN) connection. (Ensure the “Enable security on the selected interface” box is checked if you want basic firewalling). Click Next.
6. On the Name and Address Services page, choose whether this server will provide DHCP and DNS to the internal network. If you already have a separate Domain Controller handling DHCP/DNS, select “I will set up name and address services later.”
7. Click Finish. The RRAS service will start.

Step 3: Verify the NAT Configuration

To verify the setup, expand your server node in the RRAS console, expand IPv4, and click on NAT. In the right-hand pane, you should see both your Internal and External network interfaces listed.

Now, any client machine on the internal network that sets its Default Gateway to the Windows Server’s internal IP address (192.168.100.1) will have its traffic translated and routed out to the internet successfully.