Static NAT, address pools and overload

The idea

NAT explained: edgeRouter, the company's router, rewrites the inside addresses of a web server and three PCs to outside ones that an outside server sees: one to one for the server, from a pool, or everyone on one address told apart by port.

Steps

1. Static NAT for the web server

   The ISP's routes lead to the company's block 10.0.4.0/24, never to its private 10.0.1.0/24. The web server (10.0.1.10) gets 10.0.4.10 for good: a server needs one fixed outside address, or nobody outside could find it.

   edgeRouter:~# iptables -t nat -A POSTROUTING -s 10.0.1.10 -j SNAT --to-source 10.0.4.10
   webServer:~# curl -s -m 3 10.0.3.10
   edgeRouter:~# iptables -t nat -A PREROUTING -d 10.0.4.10 -j DNAT --to-destination 10.0.1.10
   outsideServer:~# curl -s -m 3 10.0.4.10

2. Four addresses, one conversation

   The web server just called out again. edgeRouter keeps each translated connection in its connection tracking table. A reply arrives addressed to 10.0.4.10, so the router needs an entry to turn it back into one for 10.0.1.10.

   edgeRouter:~# conntrack -L -p tcp