SNAT

SNAT stands for Source Network Address Translation. It is a networking technique used to modify the source IP address of packets as they pass through a routing device, typically at the network edge. By replacing a private or non-routable source address with a routable public address, SNAT enables devices inside a private network to communicate with external networks such as the Internet.

Mechanism: A device performing SNAT keeps a translation table that maps each internal source IP and port to an external source IP and port. Outbound packets are rewritten to the translated address and port. Incoming return packets are matched to the table and translated back to the original internal address and port. This allows multiple internal hosts to share a single or limited public address space.

Variants and relationships: Static SNAT uses a fixed mapping from one internal address to one external address. Dynamic SNAT uses a pool of external addresses, allocating one for a connection and releasing it when the connection closes. MASQUERADE is a related form that dynamically uses the interface’s current public IP, common when the public IP can change. SNAT differs from DNAT, which changes the destination address for inbound traffic rather than the source address for outbound traffic.

Usage and considerations: SNAT enables many internal hosts to access external networks with a limited number of public addresses. It can complicate inbound connectivity for hosts behind the NAT and requires careful management of port mappings. Performance and state-tracking overhead are considerations in high-traffic environments.

Implementation: SNAT is implemented in routers, firewalls, and gateway devices, with common configurations in Linux using iptables or nftables, pf on BSD-based systems, and various enterprise devices from vendors such as Cisco, Juniper, and Fortinet.