Re: Destination NAT question

[Anders Fugmann <afu@fugmann.dhs.org>]

Peng Gao wrote:
> Hi,
> 
> I am a student at Technical University of Munich.  I am doing my thesis 
> about Netfilter. 
> I set up the NAPT to do the Source Address Translation by the command:
> iptables -t nat  -A POSTROUTING -p udp -o eth0 -j SNAT --to 1.2.3.4:1-1023
> 
> But my question is:
> Could you please tell me the command to do the Destination Address 
> Translation for the reverse direction (from the public network to 
> private network)?
$ iptables -t nat  -A PREROUTING -p udp -o eth0 -j DNAT \
      --to-destination 5.6.7.8

would make any udp connection going out on eth0 to be changed to have 
destination address 5.6.7.8.

Allthough this command is the "reverse" of SNAT, they do not have to be 
used in pairs.

Any responses for packets being SNAT'ed will automatically be un-NAT'ed,
because netfilter keeps track of all SNAT'ed connections and makes sure 
that replies comes back to the right sender.

The same goes for DNAT.

Regards
Anders Fugmann,