Set up port forwarding on Windows 10 NAT Virtual Switch - powershell

Question

I found this excellent blog post which shows the steps to set up a NAT Virtual Switch, which I followed.
https://4sysops.com/archives/native-nat-in-windows-10-hyper-v-using-a-nat-virtual-switch/
First, the cmdlet New-NetNat does not even take an external IP as a parameter. How does NetNat know which external IP to use if there is more than one (which is my case)?
Say my host machine has an external IP "192.168.1.112" and the guest machine behind the NAT has an internal IP "10.0.75.2". I am trying to set up a port forwarding. The obvious syntax to try is:
Add-NetNatStaticMapping -NatName "NAT" -ExternalIpAddress "192.168.1.112" -ExternalPort 4000 -InternalIPAddress "10.0.75.2" -InternalPort 3389 -Protocol TCP
and I am getting the following error:
Add-NetNatStaticMapping : The external IP address 192.168.1.112 and
port number 4000 for the static mapping does not match an existing
ExternalAddress' IP address or port range. Use
Add-NetNatExternalAddress to add an ExternalAddress.
I don't understand what it means, but I follow the suggestion and type:
Add-NetNatExternalAddress -NatName "NAT" -IPAddress "192.168.1.112" -PortStart 4000 -PortEnd 4000
and I get the following error:
Add-NetNatExternalAddress : Element not found.
At this stage I have reached the limits of my competence. I can't find any relevant documentation on this NAT feature, apart from PowerShell's unhelpful tautology ("Add-NetNatExternalAddress: Adds an external address to a NAT instance.").
What does adding an External Address to a NetNat do? What happens if I don't specify the ports? Will it have any impact on the ability of the host to connect? What is the correct syntax to add an External Address in a way that will allow me to set up a Static Mapping?

Answer 1

The link above is to my blog, Cloudpuzzles. The scenario there is when using NVGRE and NAT gateways, and not the new NAT virtual switch. I don't currently have a write up about it, but Thomas here did a bit on it: http://www.thomasmaurer.ch/2015/11/hyper-v-virtual-switch-using-nat-configuration/
Basically, before adding addresses etc, you have to add a new NetNat (which is the NatName you're referring to in Add-NetNatExternalAddress).
PortStart and PortEnd, when it comes to NVGRE at least, is used as a boundary for which ports tenants can use.

Answer 2

I had the same problem and though I am not sure why the Add-NetNatExternalAddress command is failing I was able to get the NetNatStaticMapping to work by doing the below steps:
Run the following command:
Get-NetNatExternalAddress
From the list of External Addresses you get, choose any External IP and External port and use it as the parameter for the Add-NetNatStaticMapping command.

Answer 3

try something like:
Add-NetNatStaticMapping -NatName "NAT" -Protocol TCP -ExternalIPAddress 0.0.0.0 -InternalIPAddress 10.0.75.2 -InternalPort 3389 -ExternalPort 4000
This will work for sure... and I recommend you to reconsider your IP scopes...because the IP 192.168.1.11 should be in a private network, and vice versa.

Answer 4

First you need to create a Virtual Switch with NAT:
New-VMSwitch -Name "HTTPS-NAT" -SwitchType NAT -NATSubnetAddress 192.168.100.0/24
Then you need to connect the necessary VM to the specified vswitch and enable the address translation rule for all virtual machines connected through this Hyper-V virtual switch:
New-NetNat -Name HTTPS-NAT -InternalIPInterfaceAddressPrefix 192.168.100.0/24
Add-NetNatStaticMapping -ExternalIPAddress "0.0.0.0/24" -ExternalPort 443 -Protocol TCP -InternalIPAddress "192.168.100.77" -InternalPort 443 -NatName HTTPS-NAT
After executing these PowerShell commands, all HTTPS traffic that comes to port 443 of the Hyper-V host will be forwarded to the private IP address of the virtual machine.