I am currently having some issues with TCP port reused too often (under 2 minutes) for a source NAT and I was wandering what is the algorithm used to select the IP and port for a SNAT.

Here is some context: I have an entire network (, tons of users) accessing internet through one firewal (it happens to be a Fortigate). We have a public address pool (let's says to NAT all these clients IP addresses.

How will my router/firewall decide what IP address to NAT to and what source port to use?

Is this vendor specific? Do you know of any implementation that you could explain to me?

I hope my questions are clear :)

Regards, Pierre

  • Sounds like a use-case for a http/https proxy. – symcbean Mar 22 '13 at 9:04
  • There is actually a proxy, it is hosted somewhere on the internetz so I have only one destination for my NAT. – lilorox Mar 22 '13 at 11:20

This totally depends from your device (firewall) configuration/behavior. Eg. with a Linux firewall you can apply this configuration (with -j SNAT) to some matching rules, matching rules can check protocol, src/dst ports, src/dst address, maybe time of the day, etc..

  • Do you know the algorithm used in netfilter? I was also looking for a possible RFC recommanding a way to do it if it exists. – lilorox Mar 22 '13 at 10:28
  • From iptables manpage: If no port range is specified, then source ports below 512 will be mapped to other ports below 512: those between 512 and 1023 inclusive will be mapped to ports below 1024, and other ports will be mapped to 1024 or above. Where possible, no port alteration will In iptables you can specify port range with --to-source. Some interesting information in RFC5382 – Bertera Mar 24 '13 at 10:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.