Why guess if we can check and see what happens?
I've prepared a topology that represents your scenario that we will use for experiments.
Note that tunnels are not magically working, they require the underlay network to be properly configured. For the underlay network configuration, I've set up eBGP sessions between routers to get it up and running. It does not matter much for the question, so let's concentrate on NAT and tunneling.
Stage 1. No NAT, no tunnel. Let's see how the packet looks like when traveling "normally" w/o NAT or tunneling as seen on the link between
Nothing fancy, huh? Exactly as one would expect so far.
Stage 2. Adding NAT. Let's then configure the NAT rule. Note that to set up NAT we would need to have two interfaces: inside and outside. For our topology, for
cumulus6 the inside would be
swp2 and the outside would be
Here is how
Dynamic NAT is configured with Cumulus VX.
net add nat dynamic snat icmp source-ip 10.0.0.0/24 out-interface swp1 translate 188.8.131.52-184.108.40.206
It basically says that we need to dynamically translate based on the source address and outbound interface
swp1 into address
220.127.116.11. Note how the protocol is set to
icmp -- that's for simplicity. How ICMP works with NAT it's a topic of another discussion, but basically, the same way as it does for UDP and TCP. It does not matter for our question too much though.
Let's now see how the same ping between PCs will be seen now!
Okay! Now we got our addresses translated. Our host PC now looks like the
cumulus6 on the wire to other devices.
Final stage. NAT and the tunnel. Now we are ready to build the tunnel and see! As was said before tunnel relies on the underlay network for transport. I've configured the GRE tunnel with IP endpoint addresses of
10.99.99.2 on the
cumulus4 on the other side of the topology and
18.104.22.168 for underlay transport.
I've also added a static route to force traffic for
192.168.0.2 to go to the tunnel interface, and here you have it.
As you can see the outer IP header is providing the transport between
The answer. Now we are ready to give an informed answer to your question. The inner IP packet has NOT translated source IP address
10.0.0.2. You can even intuit that given the NAT definition -- when we created the NAT translation rule we had to specify the outbound interface. NAT will only be applicable if we use that interface as outbound for the traffic (
swp1 in our case), however, our packet gets routed to the tunnel interface instead, so it is not applicable!
Hope this was helpful! At least it was fun to play with :)