Destination Network Address Translation

Data Storage
Network Security

Destination Network Address Translation

In Figure 1, Internal Server (192.168.1.10) does not have a public IP address. DNAT will ensure that External Client (with a public IP address) will be able to reach Internal Server using a Public IP address (1.1.1.1):

Public Client connects to Public IP: 2.2.2.2 > 1.1.1.1
Syneto rewrites the packet by changing the packet’s destination: 2.2.2.2 > 192.168.1.10
The internal server responds: 192.168.1.10 > 2.2.2.2
Syneto determines that the response is part of the original connection (using connection tracking tables) and rewrites the response accordingly: 1.1.1.1 > 2.2.2.2

Figure 1. Destination NAT setup

A DNAT rule for the above setup implies rewriting the destination address of the packets coming in on External IP (let’s use eth0 interface for that) from 1.1.1.1 to the IP address of the Internal Server from Corporate LAN (which is on eth2 interface) – 192.168.1.10.

Figure 2. Define the DNAT rule for the example illustrated above