3

Sorry for the simplicity of the question, I just need some help.

Lets say I have a NAT rule on my firewall that translates a public IP into a private one (say 195.111.111.2 to 10.1.1.10)

I can understand how the packet traverses the internal network, but lets say an application wants to send a response back. It will have the "source address" and so knows where to send the packet, and will most likely hit some default routes on the way back out until it hits my firewall. How does my firewall know to inject the 195.111.111.2 source address back into the packet?

Do i have to set up two NATs for every NAT or is the one NAT rule implying the reverse translation will be done?

I feel this may be unclear, but hopefully it isn't.

Improve this question
2
  • this question has been answered several times before
    – Mike Pennington
    Commented May 13, 2015 at 12:27
  • Have you got any examples @MikePennington?
    – curious_nat
    Commented May 13, 2015 at 15:24

3 Answers 3

Reset to default
3

I thought I would answer my own question.

I was referring to DNAT (Destination NAT) where the destination IP is modified.

Here is a simple explanation of what happens to a packet, taken from http://www.mad-hacking.net/documentation/linux/security/iptables/nat.xml

  1. A packet arrives at the public address with that address set as its destination address and its source address set to that of the originating host.
  2. A DNAT rule is encountered where the destination address of the packet is modified to the internal IP.
  3. The firewall host makes a routing decision and sends the packet out of the correct interface destined for the address which was just rewritten. The packet's source address is unchanged and still represents the originating host.
  4. The packet arrives at the host we specified. This host then generates a response packet which it sends back to the originating host. As the source address was unchanged it should be sent back via the default gateway which will be the firewall host in the previous step.
  5. The packet is received by the firewall host which sees that it is destined for the same host which it just performed the DNAT operation for. It therefore modifies the source address of the returning packet so that it looks like it came from the address it was destined for before it was DNATed in step two.
  6. The packet arrives at the host which requested it and, as its source address is the same as that to which the original request was sent, is gratefully received.

In scenarios where default route would send the packet out of a different interface from which it was received, double NATing is the answer. For example this resource http://www.fwbuilder.org/4.0/docs/users_guide5/double_nat.shtml

Improve this answer
1
  • The key thing to remember with iptables NAT is that only the first packet of each connection goes through the NAT tables. Once a connection is known any further packets for that connection (in both directions) are simply handled according to the existing mapping.
    – Peter Green
    Commented Feb 22, 2016 at 14:34
1

The NAT'ing device keeps a table of mappings. As packets are returned to the original sender (the routable IP address that sent them) the NAT device does a lookup in that table to re-address the destination packet with the inside private IP.

Improve this answer
0

Are you coding firewall ? This may be helpful

One option can be maintain tables that will contain detail so you will require 4 fields,

source IP, Source Port, Dest IP, Dest Port.

When packet will entered then fields may be like

201.1.1.10, 80, 195.111.111.2 , 2345 let (201.1.1.10, 80 are IP and port of default internet)

then your firewall will change it to like 

195.111.111.2, Port of firewall, 10.1.1.10, port of host

and when packet will get back to your firewall 

10.1.1.10, port of host, 195.111.111.2, Port of firewall
Improve this answer
1
  • I didnt think the firewall would inject itself as the source. I thought the source would stay the same
    – curious_nat
    Commented May 13, 2015 at 15:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.