Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As you know, at least 3 types of NAT are used. Of course i need to two types of them.DNAT and SNAT. DNAT : hiding server behind NAT, SNAT : hiding your client behind NAT.


I read a quick tutorial of PF filrewall, but didn't
distinguish DNAT and SNAT in PF Firewall. How can i define ruleset as DNAT and SNAT?

share|improve this question
up vote 1 down vote accepted

I've been using NAT for a long time and this the first time I've seen the terms DNAT and SNAT. I had to go look at Wikipedia.

To help you, pay attention to Wikipedia when it says "This use of DNAT is also called port forwarding". I've only ever heard it called port forwarding. The keyword you'll want on your rules is "rdr-to".

Wikipedia points out that SNAT is used to mean many different things. With what you said, I'm assuming you are using SNAT in the sense of Source NAT.

What you are referring to as SNAT is what PF means when it uses the rule modifier "nat-to".

I don't know which tutorial you might have used, but the definitive one is at http://home.nuug.no/~peter/pf/ by Peter Hansteen. He also recently released the "Book of PF", which I own and is quite good.

PF can be confusing if you are coming from Cisco (or other) nomenclature. I know this because I got rather confused when going from PF to Cisco while taking a class.

share|improve this answer

I don't think PF makes a "clear" distinction between DNAT and SNAT. Some of these terms seem to be pretty ambiguous judging from the Wikipedia page.

But if you look here, I think you will find all sorts of options to build the rules that match the direction of the traffic you want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.