Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a private LAN connected to a firewall with multiple public IP's to use for SNAT in order not to overload the ports on a single IP. However, we have a requirement to allow certain workstations to be externally accessible on pre-defined ports that they host servers on.

In the example below, machine A has previously communicated to B a resource available on However, when machine B initiates a connection to A it will likely receive its response with a source IP different to what it expects (Because of the SNAT round robin).

I assume this must be an issue for machine B as it would not be able to correctly associate the packet in order to create the connection. What is the best solution?

iptables -t NAT -A POSTROUTING -s -o eth1 -j SNAT --to-source
iptables -t NAT -A PREROUTING -i eth1 -m multiport --dports 7045:7059 -j DNAT --to-destination

SNAT with multiple source IP's and static DNAT

share|improve this question
up vote 1 down vote accepted

I don't think there's a problem at all since incoming connections would have their own state entries which wouldn't overlap with outgoing ones. Are your problem real or just imaginary?

share|improve this answer
So if I understand correctly, the connection tracking table would remember that the destination address was and would use this same IP when doing SNAT for the remainder of the connection? At this stage I'm just designing the solution so the problem is 'imaginary' you could say. Any explanation would be greatly appreciated. – Michelle May 20 '13 at 10:30
Yep. It should work that way. – poige May 20 '13 at 10:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.