1

Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work?

Let's say, we have two stations:

A: 192.168.0.10 B: 192.168.0.20

And a router with a public IP: 10.11.12.13 that is doing Source NAT, so it changes the source address of all packets from A and B to 10.11.12.13.

But how should they ever get a response?

Isn't my home router doing both source and destination NAT?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 15, 2017 at 17:32

2 Answers 2

Reset to default
2

Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work?

That rather depends on exactly how you define those terms.

At a packet level for NAT to work translation of the packets belonging to a particular connection must be symetrical. If the outgoing packets have their source address (and possiblly port) changed the responses to those packets must have their destination address (and possiblly port) changed.

There are various approaches to handling this at an administrative and state-tracking level.

The approach taken by iptables on linux (a common implementation used on home/SMB routers among other places) is connection-orientated. The first packet of a new connection passes through the chains in the "nat" table. Based on those tables mappings are set up that apply to all packets for the connection. Later packets belonging to the connection don't pass through the chains in the "nat" table.

So when one of your machines connects to a sever on the Internet the following happens.

  1. Your client sends to initial packet.
  2. The router gets the initial packet, determines it relates to a new connection and passes it through the chains in the "nat table". The packet is matched against the SNAT rule.
  3. The router modifies the source address. It may also modify the source port if the rule requested a randomised source port or if needed to disambiguate return traffic.
  4. The router creates an entry in it's connection tracking tables describing the new connection and the translations that were performed on it.
  5. The router sends the packet onwards towards the internet.
  6. The server crafts a reply, swapping source and destination IP and port as normal.
  7. The router gets the reply packet, looks it up in it's connection tracking tables and determines it is related to an existing connection. It changes the destination IP and possibly port.
  8. The client gets it's reply with the expected addresses and ports.
  9. Further packets relating to the connection continue to be translated based on the information in the connection tracking tables.
Improve this answer
2
  • Ah thanks a lot! So to accomplish this, iptables basically needs two entries: A SNAT and a DNAT entry, right?
    – netik
    Jan 6, 2017 at 6:32
  • The user-visible tables only need to match on the first packet of the connection. The internal tracking tables do need to match on both sides, afaict this is done by a single entry which has all the relavent IPs/Ports associated and is matched by traffic in both the the "request" (same direction as the initial packet) and "response" directions (opposite direction to the initial packet).
    – Peter Green
    Jan 6, 2017 at 12:54
1

One man's source is another man's destination.

But seriously, the terms source and destination are relative to some reference, and in this case, it's the device doing the translation. So from your router's point of view, the source is its internal network.

Improve this answer
4
  • So does this mean, the router has to be configured with both SNAT and DNAT? Because, if SNAT is configured and 192.168.0.10 initiates the conversation, it gets translated to 10.11.12.13 while leaving the router. And for the reply the destn is 10.11.12.13 which gets translated back to 192.168.0.10. But if the other end starts the conversation first and tries to reach 10.11.12.13, it wont be able to reach the device(192.168.0.10) as the DNAT is not configured right? So once again, does that mean, both SNAT and DNAT has to be configured for the successful inbound and outbound conversations?
    – RRHS
    Dec 9, 2018 at 12:05
  • Most of the time, NAT is dynamic. That means the NAT is set up when the inside host sends packets outside to the destination, and when the host stops, the translation is deleted. In this way, you can have lots of hosts being translated, and you don't need to manually configure each one. In a home router, for instance, there is no translation until your inside host starts sending data. But in the case where you want outside devices to reach the host all the time, you set up a static translation (sometimes called port forwarding). It's still SNAT, but it's permanent instead of dynamic.
    – Ron Trunk
    Dec 9, 2018 at 12:56
  • I feel lost at the 2nd part regarding the outside devices reaching the host. By static translation you mean Static NAT? If thats the case,do we need port forwarding as the addresses are mapped 1 to 1? And if we do configure Static NAT, then we dont even need SNAT and DNAT as it is bidirectional, isnt it? And also i didnt quite get the last line, "It's still SNAT, but it's permanent instead of dynamic". In this case, we are talking about incoming request, so doesnt it have to be DNAT as SNAT is translation of Private address to public address. Please let me know, if i have gone wrong somewhere.
    – RRHS
    Dec 9, 2018 at 14:58
  • Yes, it's static NAT. Sometimes it's 1 to 1, and sometimes it's one to many (port forwarding) Static NAT is used for inside hosts that are reached from the Internet, like servers. But clients on the inside, like PCs don't need static NAT because they only need the NAT when browsing the web. None of what we're talking about is DNAT.
    – Ron Trunk
    Dec 9, 2018 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.