What is SNAT?

SNAT (Source NAT) rewrites the source address of outgoing packets, most often so private hosts can reach the internet via one public address.

When a host on a private range such as 10.0.0.0/24 sends a packet to the internet, the router replaces the source address with its own public address, for example 203.0.113.2, and records the change in its connection-tracking table. When the reply comes back to 203.0.113.2, the router looks up that entry and rewrites the destination back to the original host. When many hosts share one address, the router also changes source ports where needed, so each connection stays unique; this is Port Address Translation (PAT), the most common form of SNAT. Masquerade is a variant that uses whatever address the outgoing interface has at the moment, which suits a WAN address that comes from DHCP or PPPoE. On Linux, SNAT happens after routing, as packets leave the router, and depends on conntrack.

The classic SNAT rule matches traffic leaving the WAN interface and coming from the private range. Leaving out the source match means the router also translates hosts that already have public addresses, which seems to work but hides their real addresses from everyone else. Other common confusions: SNAT is not a firewall, so it still needs a forward firewall to control what's allowed; and replies only work if they come back through the same router that made the translation. It is the opposite of DNAT, which rewrites destinations for port forwarding, and CGNAT is SNAT done at ISP scale. The Setting up VyOS with NAT lesson configures source NAT step by step, including the missing-source-match mistake.