Chapter 3.5 – Source NAT
Source NAT
Network Address Translation (NAT) allows hosts on a LAN to communicate with external networks.
- Source NAT (srcnat) translates IP addresses (from a LAN) to public IP addresses when accessing the Internet. It also performs public to private IP translation when traffic is generated from the WAN to a LAN.
- Non-Publicly Routable IP addresses are IP addresses that cannot be used on the Internet.
- These private addresses are:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- These private addresses are:
masquerade & src-nat
The first chain for NAT is srcnat. It is used to apply actions to outgoing data from the router. Like firewall filters, NAT rules have some properties and actions (13 actions). The first and most basic action of NAT is action=masquerade.
masquerade replaces the source IP address in packets with another specific IP (for example, a private to public one) to facilitate routing.
- Typically, the source IP address of packets going to the Internet will be replaced by the address of the external interface (WAN).
chain=src-nat allows you to make changes to the IP address and source port of the packets to those specified by the network administrator
Usage example:
Two companies (alpha and beta) have merged, but there is a problem on their local networks since both networks use the same address space (for example, 172.16.0.0/16.). They do not want to change their network segments, since all the devices in the company (printers, projectors, copiers, etc.) have assigned addresses and it would involve loss of time.
Solution: Focusing on the concept of NAT, the only thing that will be required are basic NAT rules with src-nat and possibly rules of dst-nat, regardless of whether the local networks of each one are the same.
- Share this Article
