Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the relationship between port-forwarding and masquerading?

If server A is configured to masquerade its clients, and client B accesses the Internet through server A,

then since client B is masquerading as server A, is that essentially the same thing as having all of client B's ports forwarded?

share|improve this question

Masquerading: All machines in your internal network appear at the same (set of) public addresses. I.e., you can have 8 public IP addresses, and a network of 200 machines with private addresses using them to go "outside". When a host inside wants to open a connection to the outside, the connection gets assigned an ID address and port from this pool. It was conceived as a way of conserving IPv4 addresses when it became clear they were going scarce, and then (ab)used as a security measure (any incomming connections are at the mercy of the machine doing the translating). This is usually called NAT (Network Address Translation), if there is just one public address it is more accurately called PAT (Port Address Translation, only ports are translated). But both are usually named NAT.

Port forwarding: All traffic directed at a certain IP address and port are sent to another address and port, any responses follow the reverse path. This is usually coupled with masquerading (i.e., outside accesses the HTTP or SMTP ports on one of the masquerading addresses, traffic to that port is handled by the internal machine offering that service). It can also be done if both the forwarder and its target have public addresses, but it is rather pointless.

Firewall: A machine filtering traffic between networks, typically an internal network and the Internet, but it could also separate two internal networks. The firewall inspects connection requests and/or flowing traffic, and denies traffic (or modifies it). Is usually combined with the above two.

share|improve this answer

Masquerading = NAT

Port forwarding = telling NAT to forward new incoming traffic on a certain port to another IP and port "behind it".

If you didn't set up port forwarding on A, B isn't going to receive any new incoming connections from outside of A.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.