topic Re: SNAT vs DNAT in General Topics

SNAT vs DNAT

EDSAadmin — Tue, 30 Sep 2014 18:21:46 GMT

On our firewall we have some inbound web servers with static NAT policies using SNAT and others inbound web servers/services with DNAT policies. I am trying to figure out which one i should be using. For example the company we hired to implement our firewalls and setup policies use the SNAT way for every Static NAT policy. When I called into support for an issue one time, they stated that i should be using DNAT and not SNAT.

Re: SNAT vs DNAT

Retired Member — Tue, 30 Sep 2014 18:27:43 GMT

Hi,

you should use DNAT for inbound access or

You may use SNAT(static) for internal server with bidirectional yes option (if your each internal server has a specific public ip on WAN)

Re: SNAT vs DNAT

hshah — Tue, 30 Sep 2014 18:34:36 GMT

Hi EDSAdmin,

SNAT or DNAT both can be used, all depends on purpose.

Lets say you have FTP,HTTP and SSL servers but only one public IP addresses. And you are interested only in inbound access[Internet users should access server]. Than go for DNAT.

If you have 3 public IP addresses and you are also looking for outbound server access with same public IP than go for DNAT.

Regards,

Hardik Shah

Re: SNAT vs DNAT

ssharma — Tue, 30 Sep 2014 18:36:26 GMT

Hi EDSAdmin,

You are trying to change the destination address for traffic coming in to your network. ie. if someone tries to access 1.2.3.4 (public ip that you host) nat to internal ip 192.168.1.1. You are not changing the source IP portion of it. So you will configure DNAT. Hope that helps. Thank you.

Re: SNAT vs DNAT

EDSAadmin — Tue, 30 Sep 2014 19:18:44 GMT

Each inbound server has its own unique external static IP. Currently they are all set to be bi directional as well. I haven't had a problem with the SNAT way was just trying to get a better understanding since that time i called into support and the engineer kept telling me why are you using SNAT, you should be using DNAT.

We have Exchange server, web servers, that are all set with static external IP's.

Re: SNAT vs DNAT

hshah — Tue, 30 Sep 2014 19:20:45 GMT

Hi EDSAdmin,

Its just a matter of implementation and choice. IF you have spare public IPs than always go with SNAT.

But if there is a crunch of IPs than go with DNAT.

This is te main tie breaker for the implementation. There are number of other differences as well.

Regards,

Hardik Shah

Re: SNAT vs DNAT

Retired Member — Tue, 30 Sep 2014 19:22:25 GMT

SNAT with bidirectional option is OK then.You may use for all servers.

Re: SNAT vs DNAT

EDSAadmin — Tue, 30 Sep 2014 19:38:13 GMT

Excellent. Thanks for the clarification.