What is DNAT?

DNAT (Destination NAT) is a form of network address translation that rewrites the destination address, and often the port, of packets as they arrive at a router.

The most familiar use is port forwarding. Suppose a router's public address is 203.0.113.5 and a web server sits on a private LAN at 10.0.0.10. A DNAT rule says: when a TCP packet arrives on the WAN interface for 203.0.113.5 port 8080, change its destination to 10.0.0.10 port 80. The rewrite happens before the routing decision, so the router then routes the packet towards the LAN as if it had been sent there in the first place. The router's connection tracking remembers the translation, and the replies from the web server have their source rewritten back to 203.0.113.5:8080 automatically, without a second rule. Only the destination changes, so the server still sees the real client address in its logs.

A few points catch people out. A DNAT rule is not a firewall rule: the translated traffic still has to be allowed by the forward firewall, and on many platforms that rule must match the translated (inside) address and port, not the public ones. A rule tied to the WAN interface also doesn't apply to clients on the LAN who try the public address, which is the hairpin NAT problem, usually solved with split DNS. DNAT is the counterpart of SNAT, which rewrites the source of outgoing traffic, and both are kinds of NAT built on conntrack on Linux-based routers. Load balancers and some transparent proxies use DNAT too. The Setting up VyOS with NAT lesson builds a working port forward and the firewall rule that goes with it.