Configure NAT and watch the translation table

applied · 45 min · Objective 2.1

Task

Turn your lab router into a NAT gateway, then read the translation table while traffic flows through it. NAT is examined as a concept and troubleshot as a table, and seeing the table is what connects the two.

Steps

  1. On the router, enable masquerading from the inside to the outside interface: sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE. That is PAT — many inside addresses sharing one outside address, distinguished by port.
  2. From Host A, make a connection out to Host B: curl http://192.168.20.10/ against a python3 -m http.server 80 running there.
  3. On the router, read the translation table: sudo conntrack -L or cat /proc/net/nf_conntrack. Find the entry and identify all four values — inside local, inside global, outside local, outside global.
  4. On Host B, look at the source address of the connection in the web server's log. It is the router, not Host A. That is the observation the whole topic rests on.
  5. Now add a static NAT for one host and test it in the other direction: sudo iptables -t nat -A PREROUTING -d 192.168.20.1 -p tcp --dport 8080 -j DNAT --to-destination 192.168.10.10:80. Start a server on Host A and reach it from Host B through the router.

Verify

sudo iptables -t nat -L -n -v
sudo conntrack -L 2>/dev/null | head -5
curl -s -o /dev/null -w "%{http_code}\n" http://192.168.20.10/
curl -s -o /dev/null -w "%{http_code}\n" http://192.168.20.1:8080/

The NAT table must show both the MASQUERADE and the DNAT rule with non-zero packet counters — counters are the proof the rule is being hit, not merely present. Both curl commands must return 200, and the conntrack entry must show a translated source port.

Notes

The four-term vocabulary is what the exam tests, and it is easier against a real table. Inside local is Host A's private address. Inside global is what it is translated to. Outside global is Host B. Outside local is how Host B appears to the inside, usually identical.

The rule counters are also the troubleshooting lesson. A NAT rule that exists and shows zero packets is not matching — wrong interface, wrong direction, or a rule above it catching the traffic first. That is the same first-match-wins problem the ACL lesson in domain 5 covers, and reading the counters is how you find it in seconds rather than by inspection.

Note also what NAT does to inbound connections: nothing reaches Host A unless you configured a static mapping. That side effect gets mistaken for a firewall, and it is worth being precise that NAT is not a security control even though it has a security consequence.