What is the difference between a Source NAT, Destination NAT and Masquerading?

For example, I thought IP Masqurading was what they used to call it in Linux? But what confuses me is that in our Astaro firewall there is IP Masquarading as well as NAT options. What's the difference between all these?

  • In case you are wondering for Sophos the precedence is DNAT, SNAT, Masquerading
    – lmf
    Jan 9, 2015 at 10:26

1 Answer 1


Source NAT changes the source address in IP header of a packet. It may also change the source port in the TCP/UDP headers. The typical usage is to change the a private (rfc1918) address/port into a public address/port for packets leaving your network.

Destination NAT changes the destination address in IP header of a packet. It may also change the destination port in the TCP/UDP headers.The typical usage of this is to redirect incoming packets with a destination of a public address/port to a private IP address/port inside your network.

Masquerading is a special form of Source NAT where the source address is unknown at the time the rule is added to the tables in the kernel. If you want to allow hosts with private address behind your firewall to access the Internet and the external address is variable (DHCP) this is what you need to use. Masquerading will modify the source IP address and port of the packet to be the primary IP address assigned to the outgoing interface. If your outgoing interface has a address that is static, then you don't need to use MASQ and can use SNAT which will be a little faster since it doesn't need to figure out what the external IP is every time.

  • Thanks, that explains it very well. So source nat and probably masquerading too is equivalent to the nat keyword in freebsd's ipf while destination nat is equivalent to the rdr keyword in ipf.
    – hookenz
    Mar 7, 2010 at 20:20
  • Just found out that for freebsd, masquerading is handled by a rule like map ppp0 -> 0/32 (where the 0/32 indicates a dynamic ip).
    – hookenz
    Mar 7, 2010 at 20:30
  • 1
    Perfect answer, thanks, is not too long but really complete.
    – elbarna
    May 7, 2020 at 23:59
  • So the Source NAT, Destination NAT are indeed different from Static NAT and Dynamic NAT
    – OK999
    May 20, 2020 at 18:29
  • 1
    10 years later. This is an awesome clear answer
    – Michael
    Aug 15, 2020 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.