NAT and Basic SNAT Configuration

1. The "Why": Solving the IP Address Puzzle

The internet was built on IPv4, which provides about 4.3 billion unique addresses. With the explosion of internet-connected devices, this supply was exhausted long ago. Network Address Translation (NAT) was developed as a clever solution to this problem.

NAT allows an entire private network of computers, each with its own private IP address, to share a single public IP address to communicate with the internet.

To start, let's get a clear, high-level overview of this concept.

As the video explained, the router sits at the edge of your private network and performs this translation. When a device inside your network wants to connect to a website, the router swaps the device's private source IP address for its own public IP address before sending the request to the internet.

2. The "How": Source NAT and Connection Tracking

The specific type of NAT we've been describing is called Source NAT (SNAT), because it modifies the source IP address of the outgoing packets.

But this creates a new puzzle: if multiple internal devices are browsing the web simultaneously, their traffic all appears to come from the same public IP address. When a web server sends a reply back to the router, how does the router know which internal device to forward it to?

The answer is connection tracking. The router maintains a table that tracks every outgoing connection. It doesn't just change the IP address; it also changes the source port number. This combination of the public IP and a unique port number for each connection allows it to direct return traffic to the correct internal host.

Let's watch a detailed visualization of this process.

3. The "Practice": Configuring a Linux NAT Gateway

Now, let's put this theory into practice. Your goal is to turn a Linux machine with two network interfaces into a NAT gateway (or router). This is a common task in data center and cloud environments.

We will use the following scenario as our guide:

There are two main steps to configure this on a Linux system.

Step 1: Enable IP Forwarding

By default, a Linux system will not forward packets between its network interfaces. We must explicitly enable this functionality to make it act as a router.

You can do this temporarily with the following command:

sudo echo 1 > /proc/sys/net/ipv4/ip_forward

To make this change permanent across reboots, you need to edit the /etc/sysctl.conf file. Find the line #net.ipv4.ip_forward=1 and uncomment it by removing the #. Then apply the change with sudo sysctl -p.

Step 2: Configure the NAT Rule

For decades, the standard tool for this in Linux has been iptables. A more modern tool, nftables, is now the default in many distributions, but iptables is still incredibly widespread. You should be familiar with both.

We will use a special, dynamic form of SNAT called masquerading. This is ideal because it automatically uses the IP address of the outgoing interface (eth0 in our diagram), even if that IP is assigned dynamically via DHCP.

Using iptables (The Classic Method)

To implement the solution for our diagram, the iptables command is:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Let's break this down:

• -t nat: Specifies that we are working with the nat table, which is used for network address translation.
• -A POSTROUTING: Appends this rule to the POSTROUTING chain. This chain processes packets right before they are sent out of a network interface. This is the correct place for SNAT, as routing decisions have already been made.
• -o eth0: This is the crucial part. It makes the rule match only for packets going out of the eth0 interface (our public interface).
• -j MASQUERADE: This is the target action. It tells iptables to perform source NAT, replacing the source IP with the IP of the outgoing interface (eth0).

Using nftables (The Modern Method)

For completeness, here is how you would achieve the same result with the newer nftables tool. The logic is identical, but the syntax is different.

The nftables commands are:

# First, create the necessary table and chain
sudo nft add table inet nat
sudo nft add chain inet nat postrouting '{ type nat hook postrouting priority srcnat; }'




# Then, add the rule
sudo nft add rule inet nat postrouting oifname "eth0" masquerade

With IP forwarding enabled and one of these NAT rules in place, node-01 and node-02 can now successfully communicate with the internet through node-03.

Conclusion

You have just configured one of the most essential services in networking. By enabling IP forwarding and setting up a simple masquerading rule, you can provide internet access to an entire private network using a single Linux machine.

Key Takeaways:

• NAT's Purpose: To conserve IPv4 addresses by allowing multiple devices on a private network to share one public IP address.
• SNAT Mechanism: The router modifies the source IP of outgoing packets to its own public IP. It uses a connection tracking table (mapping source port numbers) to direct return traffic to the correct internal device.
• Masquerading: A dynamic form of SNAT in Linux, perfect for when the public IP of the router can change. It's configured in the POSTROUTING chain.
• Linux Configuration: The process involves two steps:
  1. Enabling IP forwarding (/proc/sys/net/ipv4/ip_forward).
  2. Adding a rule using iptables or nftables to masquerade traffic leaving the public interface.

In our next lesson, we will shift from routing (Layer 3) back to the foundational technologies of local area networks (Layer 2). We'll investigate how network switches prevent catastrophic network loops using the Spanning Tree Protocol (STP), ensuring the reliability of the local networks that NAT gateways connect to the internet.