What is Destination NAT (DNAT), when do you need it, and how does it complement SNAT?
DNAT replaces the destination IP of inbound packets — used when an external client needs to reach an internal server. The firewall presents a public IP to the world, but rewrites it to the internal server's IP behind the scenes. SNAT is for outbound (private→public source); DNAT is for inbound (public→private destination).
* DNAT rewrites the public destination to the internal server: a client hits the firewall's public IP, the firewall swaps in the real internal server IP, and the reply is translated back so the client only ever sees the public address. *
SNAT vs DNAT — the symmetry:
| SNAT | DNAT | |
|---|---|---|
| Direction of original packet | Outbound (inside → Internet) | Inbound (Internet → inside) |
| What's translated | Source IP (private → public) | Destination IP (public → private) |
| Purpose | Make replies routable | Make internal servers reachable |
| Common name | "Masquerading", "PAT", "NAT Overload" | "Port forwarding", "Reverse NAT" |
| Home router calls it | "NAT" (default, automatic) | "Port forwarding" (you configure it) |
Why DNAT is needed even with SNAT:
SNAT only handles connections initiated from inside. If the file server in the DMZ needs to be reachable by external customers, SNAT does nothing — there's no outbound flow to "remember." DNAT explicitly defines the public-to-private mapping.
The home router parallel:
Every home router does both:
- Automatic SNAT for all your devices (your laptop, phone, smart TV all share one public IP)
- Manual DNAT when you "port forward" port 22 to your home server for SSH
The dynamic-IP problem to watch for:
"Auch Internetprovider vergeben IP-Adressen über DHCP. Wenn Sie DNAT verwenden wollen, ist es ratsam sich vom Provider eine fixe IP-Adresse geben zu lassen oder Dynamic-DNS einzurichten."
If your public IP changes (DHCP from ISP), DNAT continues to work internally but external clients lose the address. Dynamic DNS (DynDNS, Cloudflare DNS) updates a domain name to point to your new IP automatically.
Tip: When deploying public services, the question "do I need DNAT?" almost always = "do I want internet users to reach my internal server?" If yes, DNAT. If no, SNAT alone suffices for outbound.
Go deeper:
Network address translation (Wikipedia) — destination NAT / port forwarding and its symmetry with source NAT.