Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am operating a webserver behind a NAT. Because of SSL requirements, I route 80 from multiple WAN IPs to the single internal webserver using DNAT.

Now, when packets return from the web server, how can I make sure to SNAT them from the same IP address they used to enter the nat network? Do I need to mark connections in some way?

share|improve this question

2 Answers 2

DNAT changes destination IP of the connection to another. The request is sent to the DNAT server. When the packet comes back from the webserver the source is changed automatically. You do not need to do add anything else.

SNAT is for another scenario. It is used to make detsination think the packet originates from somewhere else. This is often used in outbound connections to internet and is not related to using DNAT.

share|improve this answer

Netfilter should automatically handle that through the magic of state tracking.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.