<!doctypehtml PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><title>
   nat table
  </title><meta content="Modular DocBook HTML Stylesheet Version 1.64
"name=GENERATOR><link title="Iptables Tutorial 1.1.19"href=index.html rel=HOME><link title="Traversing of tables and chains"href=traversingoftables.html rel=UP><link title="mangle table"href=mangletable.html rel=PREVIOUS><link title="Filter table"href=filtertable.html rel=NEXT><body alink=#0000FF bgcolor=#FFFFFF class=SECTION link=#0000FF text=#000000 vlink=#840084><div class=NAVHEADER><table border=0 cellpadding=0 cellspacing=0 width=100%><tbody><tr><th align=center colspan=3>Iptables Tutorial 1.1.19<tr><td align=left valign=bottom width=10%><a href=mangletable.html> Prev </a><td align=center valign=bottom width=80%>Chapter 3. Traversing of tables and chains<td align=right valign=bottom width=10%><a href=filtertable.html> Next </a></table><hr align=LEFT width=100%></div><div class=SECTION><h1 class=SECTION><a name=NATTABLE> 3.3. nat table </a></h1><p>This table should only be used for <span class=SYSTEMITEM> NAT </span> (Network Address Translation) on different packets. In other words, it should only be used to translate the packet's source field or destination field. Note that, as we have said before, only the first packet in a stream will hit this chain. After this, the rest of the packets will automatically have the same action taken on them as the first packet. The actual targets that do these kind of things are:<p><ul><li style="list-style-type: opencircle"><p>DNAT</p><li style="list-style-type: opencircle"><p>SNAT</p><li style="list-style-type: opencircle"><p>MASQUERADE</p></ul><p>The <b class=COMMAND> DNAT </b> target is mainly used in cases where you have a public IP and want to redirect accesses to the firewall to some other host (on a <span class=SYSTEMITEM> DMZ </span> for example). In other words, we change the destination address of the packet and reroute it to the host.<p><b class=COMMAND> SNAT </b> is mainly used for changing the source address of packets. For the most part you'll hide your local networks or <span class=SYSTEMITEM> DMZ </span> , etc. A very good example would be that of a firewall of which we know outside IP address, but need to substitute our local network's IP numbers with that of our firewall. With this target the firewall will automatically <b class=COMMAND> SNAT </b> and <b class=COMMAND> De-SNAT </b> the packets, hence making it possible to make connections from the <span class=SYSTEMITEM> LAN </span> to the Internet. If your network uses 192.168.0.0/netmask for example, the packets would never get back from the Internet, because IANA has regulated these networks (among others) as private and only for use in isolated <span class=SYSTEMITEM> LAN </span> s.<p>The <b class=COMMAND> MASQUERADE </b> target is used in exactly the same way as <b class=COMMAND> SNAT </b> , but the <b class=COMMAND> MASQUERADE </b> target takes a little bit more overhead to compute. The reason for this, is that each time that the <b class=COMMAND> MASQUERADE </b> target gets hit by a packet, it automatically checks for the IP address to use, instead of doing as the <b class=COMMAND> SNAT </b> target does - just using the single configured IP address. The <b class=COMMAND> MASQUERADE </b> target makes it possible to work properly with Dynamic <span class=SYSTEMITEM> DHCP </span> IP addresses that your ISP might provide for your <span class=SYSTEMITEM> PPP </span> , PPPoE or <span class=SYSTEMITEM> SLIP </span> connections to the Internet.</div><div class=NAVFOOTER><hr align=LEFT width=100%><table border=0 cellpadding=0 cellspacing=0 width=100%><tbody><tr><td align=left valign=top width=33%><a href=mangletable.html> Prev </a><td align=center valign=top width=34%><a href=index.html> Home </a><td align=right valign=top width=33%><a href=filtertable.html> Next </a><tr><td align=left valign=top width=33%>mangle table<td align=center valign=top width=34%><a href=traversingoftables.html> Up </a><td align=right valign=top width=33%>Filter table</table></div>