Re: IPTables and different types of NAT

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Grant Taylor a écrit :
> Pedro Gonçalves wrote:
> 
>> I want to know if it is possible to use IPTables to implement
>> -Full Cone NAT
>> -Restricted Cone NAT
>> -Port Restricted Cone NAT
>> -Symmetric NAT
> 
> I see no reason why it would not be possible.

The reason is Netfilter/iptables performs UDP NAT on a per-connection 
basis (connection = source address, source port, destination address, 
destination port).

> "Full Cone Nat" could easily be implemented with inbound redirection to 
> the internal system.

"Full cone NAT" can be implemented with 1-to-1 bidirectional NAT using 
SNAT+DNAT or NETMAP.

> "Port Restricted Cone NAT" is nothing more than "Restricted Cone NAT" 
> with port filtering.  This is what is usually done if you have a server 
> behind a NATing router / firewall.  In this case, you only port forward 
> the ports that you need.

No. Please read more carefully the definitions of "restricted cone NAT" 
and "port restricted cone NAT". Neither can be implemented with iptables 
because they do not fit in the per-connection model.

> I'm not sure if there is inherent support for "Symmetric NAT" or not. 

"Symmetric NAT" works on a per-connection basis and is the NAT form that 
is the easiest to implement with iptables using SNAT or MASQUERADE.