8

Following the question in subject, I guess there is a slight difference between NAT and the others.

Is it that NAT translates a complete private network, as SNAT\DNAT translate per package?

Thanks.

4 Answers 4

12

"NAT" is a collective term for various translations - usually it's actually NAPT (involving the transport-layer/L4 port numbers as well).

Source NAT translates the source IP address (and L4 port number), usually when connecting from a private to a public IP address ("LAN to Internet"). The router stores newly created translations ('sessions') and manipulates responses accordingly in a backward fashion.

Destination NAT translates the destination IP address (and possibly the L4 port), usually when connecting from a public IP to a private IP (aka port-forwarding, reverse NAT, expose host, "public server in LAN"). While the inbound mapping is static, the return traffic also requires 'sessions' to find the original source.

Both variants work very much alike but generally differ in the way that a connection (or rather a session) is established.

4
  • 8
    Also, in the context of Linux and iptables, the reverse translation is handled by the connection tracker - so if you have SNAT rules, you don't need the corresponding explicit DNAT rules. Many people are confused by this and think they need to add the reverse rules, too.
    – dirkt
    Mar 3, 2019 at 9:18
  • @dirkt Thanks for the clearing that up!
    – whenov
    Jul 24, 2021 at 15:13
  • SNAT replaces source IP address ONLY for outgoing packets. It replaces destination addresses for incoming packets. Likewise for DNAT. The difference isn't what address they change. The difference is whether sessions are initiated outgoing or incoming. So PLEASE delete the incorrect statement about which address is changed. I see this everywhere and IT'S WRONG EVERYWHERE and leads to a lot of confusion. Nov 2, 2021 at 18:17
  • @JeffLearman NAPT is extremely common but it's actually only used for source NAT. DNAT is much more static and doesn't (need to) use NAPT.
    – Zac67
    Nov 2, 2021 at 18:26
3

DNAT: Traffic from address IPs is forwarded to a specific internal IP. or redirects the incoming traffic for some IPs or Port to particular address of your choice.

SNAT: matches for all traffic from a specific network(internal Network) to the output interface (address source used as source for the packets that match, also the output address of your network).

2

NAT is an abbreviation for Network Address Translation. SNAT is Source NAT, or, NAT for traffic in the direction of Source, or Internal network, to a Public or other network IP translation. DNAT, similarly, is Destination NAT, for traffic coming from an external Public or other network to a private networks destination, performing an IP address translation.

0

As mentioned elsewhere, NAT stands for Network Address Translation, and refers to several related functions, including some that involve port number translation as well.

The main reason NAT is required is because of private networks (like your home network, and like networks inside an enterprise.) The IP addresses in the private network are not unique; the same addresses can be used in anyone else's private network. Therefore, address translation is required so that hosts inside the private network can communicate with hosts outside the network.

In general, NAT changes the LOCAL address in a packet, which is the source address for outgoing packets and the destination for incoming packets. (In unusual cases it can do other things, but that's beyond the scope here.)

The terms SNAT and DNAT are not defined in the RFCs, and mean different things to different people. However, here are what I see as the most common definitions.

SNAT allows hosts in the private network to access public services in the Internet. It stands for "source NAT" and is a misnomer. It is also called "Traditional NAT" and "Outbound NAT" in rfc-2663. This is the NAT function provided by default by a typical home router, where you have a private network, without any special configuration. It also changes the local TCP/UDP port number (and therefore is often referred to as NAPT for Network Address and Port Translation.) It allows multiple hosts to share the same single public IP address for the network.

DNAT allows hosts outside the private network to access public services in the private network. It stands for Destination NAT, which is again a misnomer. This can also be provided by a typical home router but you have to set it up and have a clue what you're doing. Normally it does not change the TCP/UDP port number, since that identifies the service being used (for example, TCP port 80 is for a web server.)

NAT was introduced because we were running out of IP addresses, so we were forced to adopt private networks to avoid every device on a home or enterprise network consuming a global public IP address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .