Skip to content
uencoder

DNAT

DNAT (Destination NAT) rewrites a packet's destination address, typically mapping a public destination IP to an internal service IP on inbound traffic.

Purpose

It rewrites the public destination address of inbound traffic to an internal service address, enabling port forwarding and load balancing.

Mechanism

As an inbound packet crosses the DNAT device, its destination IP/port is rewritten to the internal service and the mapping is recorded. Outbound return traffic restores the public source per the mapping. Linux implements this with iptables DNAT --to-destination.

Use cases

  • Port forwarding
  • Load balancing
  • Public-to-private service mapping

Related tools

References