NAT Explained: SNAT, DNAT, One-to-One NAT and Port Forwarding

Several devices can share an Internet connection that appears outside as one public IP address. Reaching a server from outside introduces another familiar setting: port forwarding. Follow those two paths to see how NAT changes addresses and ports, and why the return path matters.

SNAT changes the sending address, and DNAT changes the receiving address. 1:1 NAT pairs one internal IP with one external IP. Let’s think of the router as a company information desk and follow the requests going out to the Internet and the requests coming into the server.

On this page

NAT is an information desk that changes addresses.

NAT (Network Address Translation) is a technology that changes the IP address of packets passing through a network to another address. A packet is a small bundle of communication data. This article covers IPv4 NAT, something you may be familiar with at home and in the office. RFC 2663: NAT Terms and Concepts

Imagine that company employees have an internal extension number, and outside the company they use a main number to contact them. The information desk connects the number to be used outside with the staff inside. NAT devices also change the address to be used internally and externally, record connection information if necessary, and send back a response.

Of course, IP is not a phone number. This analogy will only be used to help you understand that the address you use inside may be different from the address you see outside.

name	What to change or decide	a familiar scene
SNAT	Source IP address	My PC connects to the external Internet
DNAT	Destination IP address	Forward external requests to internal servers
PAT·NAPT	Correspondence between IP and port	Multiple devices share one public IP
1:1 NAT	Correspondence between one IP and one IP	Dedicate one external IP to a specific server

SNAT and DNAT refer to Which address is changed to . This is about how PAT and 1:1 NAT pair up. You don’t have to memorize them like they are four completely separate products.

Now let’s assume a small office. All packet examples are TCP communications, and addresses and ports are for illustration purposes only.

role	address	Use
employee laptop	192.168.10.10	Internal devices using the Internet
in-house web server	192.168.10.20	Internal server to access from outside
External address of NAT device	203.0.113.10	External connection and port forwarding of laptop
external website	198.51.100.80	The partner the laptop will connect to

192.168.10.x is a private address used within this office. On the Internet, you can’t just look at this address and know which office and which machine to return to. NAT is a commonly used method to connect a private IPv4 network to the Internet. The private address range is defined at RFC 1918.

Here, 203.0.113.x and 198.51.100.x are the addresses for documents assigned to the public IP role, . It cannot be used for actual Internet access. .20 and .50 that follow follow the same principle. RFC 5737: IPv4 address for document

SNAT: Change sender’s address to main number

An employee’s laptop accesses an external website. The first packet says ‘Sender is 192.168.10.10, recipient is 198.51.100.80.’ The NAT device changes the source address of this packet to 203.0.113.10 for use outside.

This is SNAT (Source NAT), source address translation. S stands for Source, ‘where it comes from.’ Below, I left the origin port as is to focus on the address change. nftables Official Wiki: Source NAT

노트북이 보낸 요청
출발지 192.168.10.10:51000
목적지 198.51.100.80:443
          ↓ SNAT
인터넷으로 나가는 요청
출발지 203.0.113.10:51000
목적지 198.51.100.80:443

In IP:포트, the number after the colon is the TCP port number. Ports are used to separate communications within one device. In the above example, 443 is the destination port of the HTTPS service, and 51000 is the source port used for communication on the laptop side.

External websites show that the request appears to come from 203.0.113.10. So I send the response there as well. A typical stateful NAT remembers the translation information for this connection and forwards the destination of returned packets back to the original laptop address.

웹사이트가 보낸 응답
출발지 198.51.100.80:443
목적지 203.0.113.10:51000
          ↓ 기존 변환의 역변환
노트북에 도착하는 응답
출발지 198.51.100.80:443
목적지 192.168.10.10:51000

The information desk essentially relays, “This reply is to the employee you contacted earlier.” Even if a connection is started with SNAT, the destination address changes in the response direction. Because of this, it is confusing to simply remember SNAT as ‘something that only happens to outgoing packets.’ RFC 3022: Transformation process of NAT

PAT: How to use a laptop and mobile phone together with one public IP

If you only use a laptop, the previous explanation seems sufficient. But what if your phone also accesses the same website and happens to use the same source port, 51000? If the outgoing IP and port are identical, the responses from the two connections cannot be distinguished.

At this time, the NAT device can assign a different external port. The method used to convert not only IP but also TCP/UDP ports is called PAT (Port Address Translation) or NAPT (Network Address Port Translation). This is a typical method of sharing one public IP among multiple devices. RFC 3022 §2.2: NAPT

device	internal departure point	Departure seen from the outside
laptop	192.168.10.10:51000	203.0.113.10:61001
mobile phone	192.168.10.11:51000	203.0.113.10:61002

For both devices, the destination is 198.51.100.80:443. If the response comes as 61001, it will be delivered to your laptop, and if it comes as 61002, it will be delivered to your mobile phone. Even though the main number is the same, the indicator to connect the reply is different.

The table is an example that shows only the correspondence between origins. Actual devices also manage protocol and connection information, and port allocation methods vary depending on implementation and settings. If there are no port conflicts, you may keep the original number. SNAT does not always mean change port.

DNAT: Directing guests from a representative address to an internal server

This time, an external user is trying to connect to an in-house web server. Since external users cannot visit the internal address 192.168.10.20 directly, the request is sent to the externally announced address 203.0.113.10:443.

The NAT device has a rule forwarding requests received on TCP 443 at this address to 192.168.10.20:443. Changing the packet’s destination address is DNAT, or Destination NAT. Router port forwarding is a familiar use of DNAT. See RFC 8512 section 1.1: Destination NAT.

Assuming the external user’s address is 198.51.100.50, it is as follows:

외부 사용자가 보낸 요청
출발지 198.51.100.50:52000
목적지 203.0.113.10:443
          ↓ DNAT
내부 서버에 전달되는 요청
출발지 198.51.100.50:52000
목적지 192.168.10.20:443

This time the starting point remains the same. In this configuration, without a separate SNAT or proxy, the server can see the IPs of external users. Port forwarding does not change all visitors to the router IP.

The server’s response goes through the same NAT device and undergoes the reverse conversion of the existing conversion. To external users, the response appears to be 203.0.113.10:443. A separate SNAT rule is not always created just for replying to this connection. The source address policy for new external connections initiated by the server must be examined separately. nftables Official Wiki: State Tracking NAT

You can even change the port number. For example, if the server actually serves HTTPS at 8443, you can connect external 443 to internal 8443. NAT does not change HTTPS to HTTP or turn on server programs that are turned off. Netgate: Port forwarding settings and target port

1:1 NAT: Pairing one external address with one server

Port forwarding selects and forwards ‘requests from this address to this port’. 1:1 NAT has a different scope. Match one internal IP and one external IP. For example, pair the separate external address 203.0.113.20 to the web server 192.168.10.20.

If we look at the information desk analogy, it means assigning a dedicated external number to a specific employee. The server’s operating system continues to have an internal IP, and the NAT device changes the address at the border. Netgate official document: 1:1 NAT

flow	Before NAT	After NAT
New request to server from outside	Destination 203.0.113.20	Destination 192.168.10.20
New request from server to outside	From 192.168.10.20	From 203.0.113.20

The first row is the role of DNAT, and the second row is the role of SNAT. A typical two-way static 1:1 NAT uses the same IP correspondence in both directions. 1:1 NAT, which changes only the IP, maintains the port number, and depending on the device, settings for two directions may be configured separately.

However, creating a 1:1 NAT does not automatically allow all ports. Address translation and firewall allowance are separate. If only web services are provided, necessary TCP 443, etc. are allowed, and management connections are not opened all at once.

Also, it doesn’t end with picking an appropriate address like 203.0.113.20 and adding it to the rule. The actual configuration requires an external IP to be allocated for use, and traffic to that address must reach the NAT device. Even if only addresses are paired for exclusive use, line bandwidth or security is not guaranteed.

If you want to connect a web port to an internal server, it is convenient to consider port forwarding first. Consider 1:1 NAT when there is a reason to keep the external address of a specific server separate and connect multiple services. Also check the product’s rule priorities and acceptance policies.

Static·Dynamic·MASQUERADE are words that answer different questions.

Static NAT, Dynamic NAT, and MASQUERADE also appear on the device settings screen. It may seem complicated as a new name is added to the concept learned earlier, but it is convenient to break down what each word defines.

terminology	meaning	scene to remember
Static NAT	Fixed address correspondence in advance	Fixed connection between internal server and external IP
Dynamic NAT	Assign correspondence from address pool when needed	Assign one of several prepared external IPs
PAT·NAPT	Separate connections by address and port	Multiple internal devices share external IP
MASQUERADE	SNAT using outgoing interface address	Linux connection where external IP may change

Traditional Basic Dynamic NAT leases addresses from a pool of IP addresses. It must be distinguished from PAT, which also shares ports when there are not enough addresses. Just because the word ‘Dynamic’ exists, it does not mean that all configurations share one public IP. RFC 2663 §2.7: Address mapping

MASQUERADE on Linux is a form of SNAT that allows you to use the address of the outgoing interface. This is useful in environments where the external IP may change. It can be distinguished from snat, which specifies a specific conversion address. nftables official wiki: Masquerading

So when you read the rules, first look at whether they change origin or destination. Next, check whether only the IP is matched or whether a port is also used. At the end, checking whether the correspondence is fixed or created on demand makes names less confusing.

NAT settings seem correct, but connection is not possible

Check the conversion, acceptance, and response paths separately

Even if you change the address correctly, communication may fail if the packet is blocked in the middle or the server responds in a different way. It’s similar to how even if the information desk tells you the room, you can’t contact them if the door is locked or the reply goes to the next building.

1. Check the service itself. From inside , check whether it is connected to the actual service port of 192.168.10.20. Check whether the program is waiting only for 127.0.0.1 and whether the server firewall is blocking it.
2. Check whether external requests arrive. Test on an external network and view logs or packet captures from the NAT device. If the packet does not arrive, check DNS, upper router, and line path first.
3. Check the conditions of the rule. Check whether the external IP, TCP·UDP distinction, external port, and internal IP and port are the same as intended. The TCP 443 rule does not cover UDP 443.
4. Check the permission policy. The forwarding policy of the NAT device and the server firewall must allow this communication. Check the product documentation to determine whether firewall rules are evaluated based on addresses, before or after conversion.
5. Check the path of the response. In a typical state tracking NAT, the response must also go through a device with translation information. Check the route to a different line from the server’s default gateway.

The relationship between the route passing through NAT and the reply route can be found in RFC 3022 §2, and the specific processing order of pfSense can be found in Netgate: NAT and firewall processing order.

It works outside, but not inside the office.

This is a situation where an internal laptop connects to the same office server using a public address. The functions that connect this flow back inward are called Hairpin NAT, NAT Loopback, NAT Reflection, etc.

Check your device’s support and settings, or review Split DNS, which points the same domain to the server’s private IP in your internal DNS. DNS is a function that resolves a name to an IP address, so if the ports are different, such as external 443 and internal 8443, you should also note that you cannot connect to the same address just by changing the DNS response. Netgate: NAT Reflection and Split DNS

If there is a NAT outside of my router

If you have a carrier router in front of your home router, the address may need to be converted twice. In a double NAT environment, external requests may not arrive even if port forwarding is performed only on the internal router. You must also look at the forwarding settings or line configuration of the parent device.

There is also Carrier-Grade NAT (CGNAT), in which carriers aggregate and translate connections from multiple subscribers. If your router’s WAN address is 100.64.0.0/10, that is, in the range from 100.64.0.0 to 100.127.255.255, check whether it uses your carrier’s shared address space. This range is distinct from RFC 1918 private addresses, such as 192.168.x.x. RFC 6598: Shared address space for telecommunication use

Just because you see this address doesn’t mean you’re assuming any configuration. Compare the router’s WAN address with the externally observed address and check with your line provider. If there is a higher level NAT that cannot be managed directly, you should consider providing a public IP or a separate connection method.

When looking at NAT, read the sender and the recipient written on the packet. All you need to do is write down on paper one request sent by the laptop and one request received by the server, and mark the values ​​that change at the boundary. Before you memorize all the names, you’ll start to see which addresses are changing and why.