How to SNAT packets from multiple IP adresses?

Question

I am operating a webserver behind a NAT. Because of SSL requirements, I route 80 from multiple WAN IPs to the single internal webserver using DNAT.

Now, when packets return from the web server, how can I make sure to SNAT them from the same IP address they used to enter the nat network? Do I need to mark connections in some way?

Answer 1

DNAT changes destination IP of the connection to another. The request is sent to the DNAT server. When the packet comes back from the webserver the source is changed automatically. You do not need to do add anything else.

SNAT is for another scenario. It is used to make detsination think the packet originates from somewhere else. This is often used in outbound connections to internet and is not related to using DNAT.

Answer 2

Netfilter should automatically handle that through the magic of state tracking.