Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am operating a webserver behind a NAT. Because of SSL requirements, I route 80 from multiple WAN IPs to the single internal webserver using DNAT.

Now, when packets return from the web server, how can I make sure to SNAT them from the same IP address they used to enter the nat network? Do I need to mark connections in some way?

share|improve this question

DNAT changes destination IP of the connection to another. The request is sent to the DNAT server. When the packet comes back from the webserver the source is changed automatically. You do not need to do add anything else.

SNAT is for another scenario. It is used to make detsination think the packet originates from somewhere else. This is often used in outbound connections to internet and is not related to using DNAT.

share|improve this answer

Netfilter should automatically handle that through the magic of state tracking.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.