How to use SNAT, DNAT, and MASQUERADE in iptables firewall

In iptables, various types of network address translation (NAT) can be flexibly implemented. SNAT and DNATSNAT are abbreviated as Sourcenetworkaddresstranslation, that is, source address translation. for example, multiple PCs use the ADSL router to share the internet. each PC is configured with an intranet IP address. when the PC accesses an external network, the router

IptablesCan flexibly perform various network address translation (NAT)

There are two main types of network address translation: SNAT and DNAT.

SNATIs the abbreviation of Source network addresstranslation, that is, Source address conversion;

For example, multiple PCs share the Internet with the ADSL router. each PC is configured with an intranet IP address. when the PC accesses an external network, the router replaces the source IP address in the packet header with the IP address of the router, when an external network server, such as a website web server, receives an access request, its log records the IP address of the router rather than the intranet IP address of the PC. this is because, the "source address" in the header of the packet received by this server has been replaced. So it is called SNAT. it is based on source address translation.

DNATIs the abbreviation of Destination networkaddress translation, that is, Destination network address translation;

A typical application is to have a web server configured with an intranet IP address on the intranet, and a firewall configured with a public IP address on the front end. visitors on the Internet use a public IP address to access the website, the client sends a packet. the destination address in the packet header is the public IP address of the firewall. the firewall will rewrite the packet header once, rewrite the target address to the intranet IP address of the web server, and then send the packet to the web server on the intranet. in this way, the packet passes through the firewall, the change from a public IP address to an access to an intranet address, that is, DNAT, is based on the target network address translation.

MASQUERADE,Address disguiseIptables has similar effects as SNAT, but there are also some differences. When using SNAT, the outbound IP address range can be one or multiple. for example, the following command means to SNAT all 10.8.0.0 network segment data packets into 192.168.5.3 IP address and then send

Iptables-t nat-a postrouting-s10.8.0.0/255.255.255.0-o eth0-j sant -- to-source 192.168.5.3

Run the following command to SNAT all 10.8.0.0 packets into several IP addresses, such as 192.168.5.3/192.168.5.4/192.168.5.5, and then send

Iptables-t nat-a postrouting-s10.8.0.0/255.255.255.0-o eth0-j sant -- to-source192.168.5.3-192.168.5.5

This is how to use SNAT. you can use NAT as an address or multiple addresses.

However, for SNAT, whether it is a few addresses, you must specify the IP address to be SNAT. If the current system uses the dynamic dialing method of ADSL, the outbound IP address 192.168.5.3 will be changed each time and the change range is large, not necessarily the IP address from 192.168.5.3 to 192.168.5.5.

At this time, if you configure iptables in the current way, the problem will occur, because the server address will change after each dial, and the IP address in the iptables rule will not change automatically, after each address change, you must manually modify iptables and change the fixed IP address in the rule to a new IP address. this is very difficult to use.

MASQUERADE is designed for this scenario. it automatically obtains the current IP address from the server's NIC for NAT.

For example, the following command:

Iptables-t nat-a postrouting-s10.8.0.0/255.255.255.0-o eth0-j MASQUERADE

You do not need to specify the destination IP address of the SNAT instance. No matter what kind of dynamic IP address eth0 obtains at the beginning, MASQUERADE automatically reads the current IP address of eth0 and then performs SNAT, which achieves a good dynamic SNAT address conversion.