Though SNAT and masquerading perform the same fundamental function, mapping one address space into another one, the details differ slightly. This feature of NAT is used to masquerade a particular internal ip adress to a given external address. As a result the internal system will be only able to source the port in range of 1024 to 10240. So when a external client makes connection to the internal server (for eg:- # telnet 22) then the port allocated to the client will be in between 1024 to 10240. This will masquerade all the ports to the range from 1024 to 10240. #iptables -A POSTROUTING -t nat -p tcp -j MASQUERADE –to-ports 1024-10240 Test by enabling logging for nat and check the log file. This will masquerade all the request from the 10.0.0.0/8 subnet to the external ip of the firewall. # iptables -t nat -A POSTROUTING -j MASQUERADE -s 10.0.0.0/8 # iptables -t nat -A POSTROUTING -j MASQUERADEĪnother example that masquerades all the traffic from network 10.0.0.0/8 The following example will masquerade all the outgoing traffic to the externel bound IP of the firewall. This feature of NAT is used to dynamically masquerade all the internal address to the external IP Eg:- If the firewall has more than one IP address using this chain we can re-write the packets going out from this linux machine to a single IP. Locally sourced/generated packets are subjected to NAT. eg:- MASQUERADE option is used in certain cases like, if ISP provides the DHCP address and the internel LAN needs to brows, then we have to masquerade all the request from the lan to the DHCP address provided by isp (Changes the packet after it leaves the route from lan). When packet needs to leave from one subnet(internel) through the linux firewall to another it traverse through POSTROUTING chain. This is responsible for MASQUERADE (dynamic SNAT) & SNAT. Using this we will make available of our internal service to external (Internet).i.e, from internet to lan (changes the packets before it routes to lan) The DNAT is defined in the PREROUTING chain. NAT is commonly used to masquerade the IP address Network Address Translation is the feature that makes Linux based firewall mostly in use. all other traffic will be denied.So the servers in the DMZ2 zone will be more secured. Here we have to permit only the DMZ1 to contact the DMZ2. This is used for the scenarios of Application servers which need to contact the DB Servers located on separate server. Using this method we will be able to control the traffic from one DMZone to another.

eth3: The DMZ2 zone (172.17.0.0/16) (DBMS, App servers like JBOSS, TOMCAT etc).

Let consider the interface to setup/understand the Dual DMZ. This is the way of segmenting the servers to separate DMZones. Because the default policy of FORWARD chain is set to drop, we need to create the “state match” for the hosts in the DMZone(This will deny sourcing a new connection from the DMZone, only established connection will be permitted).

Use native nf_tables set infrastructure.This will deny all access to the DMZone from the internet hosts, only allows the Internal network.

To emulate iptables -ports you need two rules.

nft_payload, through native range support.

Refer to matching UDP/TCP headers in the same rule.

Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira).

Refer to Quick_reference-nftables_in_10_minutes#Meta.

Examples from iptables-translate testsuite.

Supported extensions matches: xt addrtype

consider native interface, need to extend nft_exthdr.c.

Refer to Matching_connection_tracking_stateful_metainformation. To the day, the only use case for this was DHCP clients not working with partial checksums.

Iptables netmap example