LFCE 80 🐧 NAT — Concepts - KandZ

⏱️ Estimated read: 14 min | |

Network Address Translation is the mechanism that rewrites the source or destination address of a packet as it passes through a router. It was introduced to extend the life of IPv4, and it remains the reason that private networks can reach the internet through a single public address. The previous chapters covered the firewall rules that accept or drop packets; this chapter covers the rules that change the addresses, and the table that holds them. The LFCE exam objectives include configuring a system to route IP traffic, and NAT is the mechanism that makes routing useful for a private network behind a public address.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

NAT operates at the boundary between two networks. The nat table in nftables—or the nat table in iptables—contains the rules that perform the translation. The prerouting chain handles destination NAT, which is used to publish an internal service on a public address. The postrouting chain handles source NAT, which is used to let internal hosts reach the internet through the router’s public address . The masquerade statement is a special form of source NAT that uses the outgoing interface’s address, which is appropriate when the public address is assigned dynamically.

Key point: Source NAT rewrites the source address of outgoing packets so that the replies return to the router, which then rewrites them back to the original internal address. Destination NAT rewrites the destination address of incoming packets so that they reach an internal server, and the router rewrites the replies back to the original client. Both directions require connection tracking, because the router must remember the original addresses to reverse the translation . The masquerade statement is a source NAT that automatically uses the address of the outgoing interface, which is the correct choice when the public address is dynamic.

Why NAT requires connection tracking

The reply-rewriting problem.

When an internal host sends a packet to the internet, the source address is a private address that the internet cannot route. The router rewrites the source address to its public address before sending the packet out. The reply from the internet is addressed to the public address, and the router must rewrite the destination back to the internal address before forwarding it to the host. The router knows the original internal address only because the connection-tracking subsystem recorded the translation when the outgoing packet passed through . Without connection tracking, the router would have no way to reverse the translation, and the reply would be delivered to the router itself instead of the internal host.

The port-collision problem.

Multiple internal hosts may use the same source port for their connections. If the router rewrites only the address, the replies cannot be distinguished, because they all arrive at the same public address and the same port. The source NAT must also rewrite the source port, assigning a unique port to each connection, and the connection-tracking table records the mapping . This is why source NAT is sometimes called “NAT with port translation” or “PAT” (Port Address Translation). The masquerade statement performs both the address and port translation automatically.

The destination-NAT problem.

Destination NAT publishes an internal service on a public address. The client sends a packet to the public address and port, and the router rewrites the destination to the internal server’s address and port. The server replies to the client, and the router must rewrite the source of the reply back to the public address. The connection-tracking subsystem records the destination translation so that the reply can be reversed . The same subsystem handles both directions, which is why a single nat table can contain both prerouting and postrouting rules.

a. Source NAT and masquerade

Source NAT rewrites the source address of outgoing packets. It is used when the internal hosts need to reach the internet through the router’s public address. The snat statement specifies a fixed address, and the masquerade statement uses the outgoing interface’s address.

# nftables: source NAT to a fixed address
sudo nft add table ip nat
sudo nft add chain ip nat postrouting { type nat hook postrouting priority 100\; }
sudo nft add rule ip nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat to 203.0.113.5

The table ip nat creates the nat table in the ip family. The postrouting chain is attached to the postrouting hook with the nat type and a priority of 100. The rule matches packets from the 192.168.1.0/24 network that leave on eth0, and it rewrites the source address to 203.0.113.5 . The fixed address is appropriate when the public address is static.

The masquerade statement is the alternative when the public address is dynamic, such as a DHCP-assigned address.

# nftables: masquerade on the outgoing interface
sudo nft add rule ip nat postrouting oif eth0 masquerade

The masquerade statement rewrites the source address to the address of the outgoing interface, whatever it is at the moment the packet is sent. It also rewrites the source port, which is the port translation that allows multiple internal hosts to share the address . The masquerade statement is the correct choice for a router with a DHCP-assigned public address, because the address can change without updating the rule.

The equivalent iptables commands are -j SNAT --to-source and -j MASQUERADE.

# iptables: source NAT
sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 203.0.113.5

# iptables: masquerade
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The -t nat flag selects the nat table, and the POSTROUTING chain is the source-NAT chain. The -s and -o matches restrict the rule to the internal network and the outgoing interface . The SNAT target uses the fixed address, and the MASQUERADE target uses the interface’s address.

b. Destination NAT and port forwarding

Destination NAT rewrites the destination address of incoming packets. It is used to publish an internal service on a public address, such as a web server or an SSH server.

# nftables: destination NAT to an internal web server
sudo nft add chain ip nat prerouting { type nat hook prerouting priority -100\; }
sudo nft add rule ip nat prerouting iif eth0 tcp dport 80 dnat to 192.168.1.10:80

The prerouting chain is attached to the prerouting hook with the nat type and a priority of -100, which is evaluated before the routing decision. The rule matches packets that arrive on eth0 destined for port 80, and it rewrites the destination to 192.168.1.10:80 . The internal server receives the packet as if it were addressed to its own address, and the reply is rewritten back to the public address by the connection-tracking subsystem.

The dnat statement can also change only the address, leaving the port unchanged, or change both.

# nftables: destination NAT to a different port
sudo nft add rule ip nat prerouting iif eth0 tcp dport 8080 dnat to 192.168.1.10:80

The rule maps port 8080 on the public address to port 80 on the internal server, which is a common pattern for running a service on a non-standard port . The dnat statement rewrites the destination address and port, and the connection-tracking subsystem records the mapping so that the reply can be reversed.

The equivalent iptables command is -j DNAT --to-destination.

# iptables: destination NAT
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80

The -t nat flag selects the nat table, and the PREROUTING chain is the destination-NAT chain. The -i eth0 match restricts the rule to the incoming interface, and the --dport 80 match restricts it to the destination port . The DNAT target rewrites the destination address and port.

c. The forwarding requirement and hairpin NAT

NAT is not sufficient on its own. The router must also forward the packets, which requires ip_forward to be enabled and the forward chain to allow the traffic. The nat table rewrites the addresses, and the filter table decides whether the packet is allowed to pass.

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Allow forwarding in the filter table
sudo nft add rule inet filter forward iif eth0 oif eth1 ct state established,related accept
sudo nft add rule inet filter forward iif eth1 oif eth0 accept

The sysctl -w net.ipv4.ip_forward=1 command enables the kernel’s forwarding capability. The filter table’s forward chain must allow the traffic in both directions . The NAT rule rewrites the addresses, but the forwarding rule decides whether the packet is allowed to pass between the interfaces.

Hairpin NAT is the case where an internal host needs to reach another internal host through the public address. The client sends the packet to the public address, and the router rewrites the destination to the internal server. The server replies directly to the client, but the reply’s source address is the server’s private address, not the public address that the client expects. The connection fails because the client’s connection-tracking entry expects a reply from the public address . The solution is a source-NAT rule that rewrites the reply’s source address back to the public address, which is called hairpin NAT or NAT reflection.

# Hairpin NAT for internal clients reaching the public address
sudo nft add rule ip nat postrouting ip saddr 192.168.1.0/24 ip daddr 192.168.1.10 snat to 203.0.113.5

The rule matches traffic from the internal network to the internal server, and it rewrites the source to the public address. The reply then matches the client’s connection-tracking entry, and the connection succeeds . Hairpin NAT is a special case that is not needed when the clients can use the internal address directly.

Complete Example Session

# ============================================
# PART 1: ENABLE IP FORWARDING
# ============================================
sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.d/99-forwarding.conf

# ============================================
# PART 2: CREATE THE NAT TABLE
# ============================================
sudo nft add table ip nat

# ============================================
# PART 3: CREATE THE POSTROUTING CHAIN
# ============================================
sudo nft add chain ip nat postrouting { type nat hook postrouting priority 100\; }

# ============================================
# PART 4: ADD THE MASQUERADE RULE
# ============================================
sudo nft add rule ip nat postrouting oif eth0 masquerade

# ============================================
# PART 5: CREATE THE PREROUTING CHAIN
# ============================================
sudo nft add chain ip nat prerouting { type nat hook prerouting priority -100\; }

# ============================================
# PART 6: ADD THE DNAT RULE
# ============================================
sudo nft add rule ip nat prerouting iif eth0 tcp dport 80 dnat to 192.168.1.10:80

# ============================================
# PART 7: ALLOW FORWARDING
# ============================================
sudo nft add rule inet filter forward iif eth0 oif eth1 ct state established,related accept
sudo nft add rule inet filter forward iif eth1 oif eth0 accept

# ============================================
# PART 8: VERIFY THE NAT RULES
# ============================================
sudo nft list table ip nat
# Output shows the postrouting and prerouting rules

# ============================================
# PART 9: TEST SOURCE NAT
# ============================================
# From an internal host: curl http://ifconfig.me
# The public address is the router's address, not the internal address

# ============================================
# PART 10: TEST DESTINATION NAT
# ============================================
# From an external host: curl http://203.0.113.5
# The request reaches the internal server at 192.168.1.10

The ten parts demonstrate the NAT configuration: forwarding, the nat table, the postrouting chain, the masquerade rule, the prerouting chain, the dnat rule, the forwarding rules, the verification, the source-NAT test, and the destination-NAT test. The critical requirement is Part 1: without ip_forward, the router does not forward the packets, and the NAT rules have no effect.

Quick Reference

NAT Types

Type	Chain	Purpose
Source NAT	`postrouting`	Internal hosts reach the internet
Masquerade	`postrouting`	Source NAT with a dynamic address
Destination NAT	`prerouting`	Publish an internal service

nftables Statements

Statement	Purpose	Example
`snat to <addr>`	Rewrite source to a fixed address	`snat to 203.0.113.5`
`masquerade`	Rewrite source to the interface’s address	`masquerade`
`dnat to <addr>:<port>`	Rewrite destination	`dnat to 192.168.1.10:80`

iptables Targets

Target	Table	Purpose
`SNAT`	`nat POSTROUTING`	Fixed source address
`MASQUERADE`	`nat POSTROUTING`	Dynamic source address
`DNAT`	`nat PREROUTING`	Destination rewrite

Prerequisites

Requirement	Command
IP forwarding	`sysctl -w net.ipv4.ip_forward=1`
Forward chain	Allow traffic in `filter forward`
Connection tracking	Enabled by default

Best Practices

✅ Do This:

# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1                                # ✅

# Use masquerade for dynamic public addresses
oif eth0 masquerade                                            # ✅

# Use snat for fixed public addresses
ip saddr 192.168.1.0/24 oif eth0 snat to 203.0.113.5           # ✅

# Put dnat in prerouting
iif eth0 tcp dport 80 dnat to 192.168.1.10:80                  # ✅

# Allow forwarding in the filter table
iif eth0 oif eth1 ct state established,related accept          # ✅

# Use hairpin NAT for internal clients reaching the public address
ip saddr 192.168.1.0/24 ip daddr 192.168.1.10 snat to 203.0.113.5 # ✅

❌ Don’t Do This:

# Forget to enable ip_forward
# NAT rules have no effect                                   # ❌

# Put dnat in postrouting
dnat to 192.168.1.10    # Too late; routing decision made     # ❌

# Use snat with a dynamic address
snat to 203.0.113.5    # Breaks when the address changes      # ❌

# Forget the forward chain rules
# Packets are dropped after NAT                              # ❌

# Use masquerade for a fixed address
# Unnecessary overhead                                       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
NAT has no effect	`ip_forward` disabled	`sysctl -w net.ipv4.ip_forward=1`
Replies not returned	Connection tracking missing	Ensure conntrack is enabled
DNAT not working	Rule in `postrouting`	Move to `prerouting`
Internal clients cannot reach the public address	No hairpin NAT	Add the hairpin rule
Forwarded packets dropped	`filter forward` denies	Allow the traffic

Real-World Examples

1. Enable forwarding

sysctl -w net.ipv4.ip_forward=1

2. Masquerade

nft add rule ip nat postrouting oif eth0 masquerade

3. SNAT

nft add rule ip nat postrouting ip saddr 192.168.1.0/24 oif eth0 snat to 203.0.113.5

4. DNAT

nft add rule ip nat prerouting iif eth0 tcp dport 80 dnat to 192.168.1.10:80

5. DNAT port mapping

nft add rule ip nat prerouting iif eth0 tcp dport 8080 dnat to 192.168.1.10:80

6. Allow forwarding

nft add rule inet filter forward iif eth0 oif eth1 accept

7. Hairpin NAT

nft add rule ip nat postrouting ip saddr 192.168.1.0/24 ip daddr 192.168.1.10 snat to 203.0.113.5

8. iptables masquerade

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

9. iptables DNAT

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80

10. Verify NAT

nft list table ip nat

Visual

Source NAT

┌──────────────────────────────────────────────────────────────┐
│  SOURCE NAT REWRITES THE SOURCE OF OUTGOING PACKETS          │
│                                                              │
│  Internal host (192.168.1.50)                                │
│       │ src: 192.168.1.50:12345                              │
│       ▼                                                      │
│  Router                                                      │
│       │ postrouting: snat to 203.0.113.5                     │
│       ▼                                                      │
│  Internet                                                    │
│       │ src: 203.0.113.5:54321                               │
│       ▼                                                      │
│  Reply to 203.0.113.5:54321                                  │
│       │                                                      │
│       ▼                                                      │
│  Router (conntrack reverses)                                 │
│       │ dst: 192.168.1.50:12345                              │
│       ▼                                                      │
│  Internal host receives the reply                            │
└──────────────────────────────────────────────────────────────┘

Destination NAT

┌──────────────────────────────────────────────────────────────┐
│  DESTINATION NAT REWRITES THE DESTINATION OF INCOMING PACKETS│
│                                                              │
│  External client                                             │
│       │ dst: 203.0.113.5:80                                  │
│       ▼                                                      │
│  Router                                                      │
│       │ prerouting: dnat to 192.168.1.10:80                  │
│       ▼                                                      │
│  Internal server (192.168.1.10)                              │
│       │ receives the request                                 │
│       │ reply to the client                                  │
│       ▼                                                      │
│  Router (conntrack reverses)                                 │
│       │ src: 203.0.113.5:80                                  │
│       ▼                                                      │
│  External client receives the reply                          │
└──────────────────────────────────────────────────────────────┘

Hairpin NAT

┌──────────────────────────────────────────────────────────────┐
│  INTERNAL CLIENTS NEED HAIRPIN NAT FOR THE PUBLIC ADDRESS    │
│                                                              │
│  Without hairpin:                                            │
│  Client → 203.0.113.5 → DNAT → 192.168.1.10                  │
│  Server replies directly to the client from 192.168.1.10     │
│  Client expects a reply from 203.0.113.5 → connection fails  │
│                                                              │
│  With hairpin:                                               │
│  Client → 203.0.113.5 → DNAT → 192.168.1.10                  │
│  Server replies to 192.168.1.50                              │
│  Router's postrouting rule rewrites the source to 203.0.113.5│
│  Client receives the reply from 203.0.113.5 → connection OK  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Source NAT	`postrouting` chain
Masquerade	Source NAT with dynamic address
Destination NAT	`prerouting` chain
Source NAT statement	`snat to <addr>`
Masquerade statement	`masquerade`
Destination NAT statement	`dnat to <addr>:<port>`
Prerequisite	`net.ipv4.ip_forward=1`
Forwarding	`filter forward` chain
Connection tracking	Required for reply rewriting
Hairpin NAT	SNAT for internal-to-public traffic

Key takeaways:

Source NAT rewrites the source address of outgoing packets. It is used when internal hosts need to reach the internet through the router’s public address. The snat statement uses a fixed address, and the masquerade statement uses the interface’s dynamic address . The router must also have ip_forward enabled and the filter forward chain must allow the traffic.
Destination NAT rewrites the destination address of incoming packets. It is used to publish an internal service on a public address. The dnat statement belongs in the prerouting chain, which is evaluated before the routing decision . The connection-tracking subsystem records the translation so that the reply can be reversed.
Connection tracking is required for both directions. The router must remember the original addresses and ports to reverse the translation. Without it, the replies cannot be delivered to the correct host .
Masquerade is the correct choice for dynamic addresses. It uses the outgoing interface’s address, which can change without updating the rule. snat is the correct choice for fixed addresses, because it avoids the overhead of looking up the interface’s address .
Hairpin NAT is needed when internal clients use the public address. The client’s connection-tracking entry expects a reply from the public address, but the server replies from its private address. A source-NAT rule that rewrites the reply’s source to the public address solves the problem .
The nat table is separate from the filter table. The nat table rewrites the addresses, and the filter table decides whether the packet is allowed to pass. Both must be configured for the NAT to work.

Remember: NAT is the mechanism that lets a private network share a public address. Source NAT rewrites the source of outgoing packets, and destination NAT rewrites the destination of incoming packets. Both require connection tracking to reverse the translation, and both require ip_forward and the filter forward rules to let the packets pass. The masquerade statement is the source NAT for dynamic addresses, and the snat statement is the source NAT for fixed addresses. The dnat statement publishes an internal service on a public address. Hairpin NAT is the special case for internal clients that use the public address. The nat table and the filter table are separate, and both must be configured for the connection to succeed.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!