LOGBOOK

HELP

Quiz Entry - updated: 2026.07.14

What is Destination NAT (DNAT), when do you need it, and how does it complement SNAT?

DNAT replaces the destination IP of inbound packets — used when an external client needs to reach an internal server. The firewall presents a public IP to the world, but rewrites it to the internal server's IP behind the scenes. SNAT is for outbound (private→public source); DNAT is for inbound (public→private destination).

Firewall rewrites the public destination to the internal server; the reply is reversed back.

* DNAT rewrites the public destination to the internal server: a client hits the firewall's public IP, the firewall swaps in the real internal server IP, and the reply is translated back so the client only ever sees the public address. *

SNAT vs DNAT — the symmetry:

SNAT DNAT
Direction of original packet Outbound (inside → Internet) Inbound (Internet → inside)
What's translated Source IP (private → public) Destination IP (public → private)
Purpose Make replies routable Make internal servers reachable
Common name "Masquerading", "PAT", "NAT Overload" "Port forwarding", "Reverse NAT"
Home router calls it "NAT" (default, automatic) "Port forwarding" (you configure it)

Why DNAT is needed even with SNAT:

SNAT only handles connections initiated from inside. If the file server in the DMZ needs to be reachable by external customers, SNAT does nothing — there's no outbound flow to "remember." DNAT explicitly defines the public-to-private mapping.

The home router parallel:

Every home router does both:

  • Automatic SNAT for all your devices (your laptop, phone, smart TV all share one public IP)
  • Manual DNAT when you "port forward" port 22 to your home server for SSH

The dynamic-IP problem to watch for:

"Auch Internetprovider vergeben IP-Adressen über DHCP. Wenn Sie DNAT verwenden wollen, ist es ratsam sich vom Provider eine fixe IP-Adresse geben zu lassen oder Dynamic-DNS einzurichten."

If your public IP changes (DHCP from ISP), DNAT continues to work internally but external clients lose the address. Dynamic DNS (DynDNS, Cloudflare DNS) updates a domain name to point to your new IP automatically.

Tip: When deploying public services, the question "do I need DNAT?" almost always = "do I want internet users to reach my internal server?" If yes, DNAT. If no, SNAT alone suffices for outbound.

Go deeper:

From Quiz: INTROL / Firewall Basics Lab (Palo Alto PA-440) | Updated: Jul 14, 2026