Nat – Source NAT and Destination NAT

nat;

Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work?

Let's say, we have two stations:

A: 192.168.0.10
B: 192.168.0.20

And a router with a public IP: 10.11.12.13 that is doing Source NAT, so it changes the source address of all packets from A and B to 10.11.12.13.

But how should they ever get a response?

Isn't my home router doing both source and destination NAT?

Best Answer

Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work?

That rather depends on exactly how you define those terms.

At a packet level for NAT to work translation of the packets belonging to a particular connection must be symetrical. If the outgoing packets have their source address (and possiblly port) changed the responses to those packets must have their destination address (and possiblly port) changed.

There are various approaches to handling this at an administrative and state-tracking level.

The approach taken by iptables on linux (a common implementation used on home/SMB routers among other places) is connection-orientated. The first packet of a new connection passes through the chains in the "nat" table. Based on those tables mappings are set up that apply to all packets for the connection. Later packets belonging to the connection don't pass through the chains in the "nat" table.

So when one of your machines connects to a sever on the Internet the following happens.

  1. Your client sends to initial packet.
  2. The router gets the initial packet, determines it relates to a new connection and passes it through the chains in the "nat table". The packet is matched against the SNAT rule.
  3. The router modifies the source address. It may also modify the source port if the rule requested a randomised source port or if needed to disambiguate return traffic.
  4. The router creates an entry in it's connection tracking tables describing the new connection and the translations that were performed on it.
  5. The router sends the packet onwards towards the internet.
  6. The server crafts a reply, swapping source and destination IP and port as normal.
  7. The router gets the reply packet, looks it up in it's connection tracking tables and determines it is related to an existing connection. It changes the destination IP and possibly port.
  8. The client gets it's reply with the expected addresses and ports.
  9. Further packets relating to the connection continue to be translated based on the information in the connection tracking tables.
Related Topic