Say we have a Linux based router with WAN interface
eth0 ip addr
220.127.116.11 (w/ whatever gw ip) and LAN interface
eth1 ip addr
192.168.51.1/24, which means we need an iptables rule below to make the router or nat gateway to work (together with ipv4 forwarding enabled in sysctl):
iptables -t nat -A POSTROUTING -s 192.168.51.0/24 -j MASQUERADE
Then we've got a new device connected on the LAN interface, with ip addr
192.168.51.2/24 and gw
192.168.51.1, so it could connect to public internet through the gw as expected.
Now the device want to access a web server on
18.104.22.168, the http request traffic should be from src like
192.168.51.2:40960 (a random src port) to dst
22.214.171.124:80, and when the traffic goes thru the router, it should be changed to src like
126.96.36.199:50961 (another random src port selected and recorded on the Network Translation Port Table) to dst
Then when the response heads back, the packet with dst
188.8.131.52:50961 will be reversed back to
192.168.51.2:40960 based on the NAPT and well received. Everything's working so far so well.
Now the Problem comes, we want to setup the device
192.168.51.2 as a DMZ host. We add one more iptables rule like:
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.51.2
Now let's imagine the device want to access the same web service again. This time when the response comes back from
184.108.40.206:80 to dst
220.127.116.11:50961, we need to know which path it should go - either
192.168.51.2:50961 according to the DNAT rule we just set, or the
192.168.51.2:40960 based on the NAPT record when the traffic went out from the WAN?
Which one has... let's say - higher priority... to process the packets of the response?
Thanks in advance.