Sanitation publishes a SCADA historian reverse proxy with a permanent public mapping. Which NAT type best matches that one-to-one inbound publish use-case?

Sanitation publishing a SCADA historian reverse proxy with a permanent public mapping needs one-to-one static NAT. Static NAT permanently maps the interior historian or proxy address to a dedicated public address so inbound vendor or operations sessions always hit the same published endpoint. That permanent publish model matches utility telemetry and historian access patterns where partners must bookmark a stable public address rather than chasing dynamic translations.

CGNAT carrier-grade pools that dynamically share ports across every utility district fail because CGNAT-style dynamic sharing is many-to-one conservation, not a dedicated permanent inbound publish for one historian. NAT overload (PAT) that only creates mappings after interior hosts browse outbound fails because overload is outbound-driven and does not provide a lasting inbound public door by itself. Multicast RPF strict-mode filtering on the historian VLAN fails because RPF protects multicast forwarding paths; it is not a NAT publish type.

Exam caveat: permanent inbound publish = static one-to-one; many private clients sharing scarce public IPv4 = PAT/overload/CGNAT themes. Do not pick multicast RPF distractors when the stem is clearly about address translation for a published service. Firewall policy must still allow the historian ports after the static mapping exists.

Operational check: verify the static translation entry, confirm DNS or partner configs point at the public address, test inbound access from an external jump host, and ensure ACL/firewall counters increment on the published ports without leaking broader SCADA subnets.