More About Network Address Translation
The netfilter software is capable of many different types of Network Address Translation. IP Masquerade is one simple application of it.
It is possible, for example, to build NAT rules that translate only certain addresses or ranges of addresses and leave all others untouched, or to translate addresses into pools of addresses rather than just a single address, as masquerade does. You can in fact use the iptables command to generate NAT rules that map just about anything, with combinations of matches using any of the standard attributes, such as source address, destination address, protocol type, port number, etc.
Translating the Source Address of a datagram is referred to as “Source
NAT,” or SNAT
, in the netfilter
documentation. Translating the Destination Address of a datagram is known as
“Destination NAT,” or DNAT
. Translating the TCP
or UDP port is known by the term REDIRECT
.
SNAT
, DNAT
, and
REDIRECT
are targets that you may use with the
iptables command to build more complex and sophisticated
rules.
The topic of Network Address Translation and its uses warrants at least a whole chapter of its own.[68] Unfortunately we don’t have the space in this book to cover it in any greater depth. You should read the IPTABLES-HOWTO for more information, if you’re interested in discovering more about how you might use Network Address Translation.
[68] ... and perhaps even a whole book!
Get Linux Network Administrator's Guide, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.