2

From https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13770-1.html

This document provides a sample configuration with the ip nat outside source list command, and includes a brief description of what happens to the IP packet during the NAT process. You can use this command to translate the source address of the IP packets that travel from outside of the network to inside the network. This action translates the destination address of the IP packets that travel in the opposite direction—from inside to outside of the network.

During the NAT process for a packet that travels from the outside to inside of a private network, shouldn't the destination address of the packet be translated, why it writes "source address"?

During the NAT process for a packet that travels from the inside to outside of a private network, it writes the destination address of the packet is translated, which I agree.

Thanks.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 15, 2019 at 1:30

2 Answers 2

Reset to default
6

You can translate inside addresses, or outside addresses, or both.

We all use private addressees on our home (and many business) networks, so we translate inside addresses to public ones.

Sometimes companies have to communicate with other entities that have overlapping addresses, so we translate the outside addresses into a non-overlapping range

And sometimes, we need to do both.

Improve this answer
5

For a network connection, packets flow in both directions. Generally, any network connection between a public and a private address requires translation - the public IP side cannot send to a private IP address.[*]

Accordingly, when connecting from private to public you need source NAT, and when connecting from public to private you need destination NAT. In both cases, the "translation direction" is the direction in which the connection is established.

SNAT first translates the source IP address of the request to a public IP and when the response comes back its (public) destination IP is translated back to the former (private) source IP.

DNAT works exactly the other way around: the request's destination IP is translated to the private IP and the response's source IP is translated back to the former (public) destination IP.

Note that "request" and "response" are just placeholders for packets sent in the direction of connection establishment or the opposite direction. Even for a connectionless protocol like UDP the NAT router needs to treat the flows like there was a connection.

Also note that the most commonly NAT variant is NAPT that includes the transport-layer protocols and their ports into the translation.

[*] There are situations when you actually can mix private and public IP addresses, especially when the public hosts are yours and have a specific route into your private network.

Improve this answer
5
  • Thanks. When two computers in a private network contact the same server (at same IP address) on the Internet at the same time, when the server sends back the responses to the router of the private network, how can the router know which compute to send each response to?
    – Tim
    Commented Mar 29, 2019 at 13:32
  • 1
    The router keeps a mapping between private 5 tuple (protocol, src+dst IP, src+dst ports) for each flow on the inside and what it was mapped to on the outside. when the server responds, the only difference between the 2 flows would be the destination port (from the server pespective) and the router uses this to map to the correct internal flow
    – Owensteam
    Commented Mar 29, 2019 at 13:35
  • worth noting as well that in your example, there is no DNAT, only SNAT. NAT is directional (on Cisco kit "ip nat inside/outside"). on the way out SNAT hits the source address and NATs private->public IP. On the return trip, the router sees the packet as having a match on the SNAT rule but because traffic is going in the other direction it gets its destination NATed. DNAT is called un-nat on cisco kit
    – Owensteam
    Commented Mar 29, 2019 at 13:38
  • @Owensteam Thanks. I was wondering what commands I could use to see the NAT tables on Linux
    – Tim
    Commented Mar 29, 2019 at 13:43
  • if you want to see NAT tables on linux then you're looking at iptables probably. try "sudo iptables -L -vt nat". You'll need to do a fair bit of blogtrekking before you can wrap your head round it though! If you have iptables questions then best ask another q after googling
    – Owensteam
    Commented Mar 29, 2019 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.