IF Nating is done in OUTPUT chain of the NAT table, then what is the function of SNAT in POSTROUTING
Have a look at this diagram. The green boxes are for
iptables, the blue are for
ebtables (ignore those).
So you see that the
OUTPUT chain is only traversed for packets produced by local applications, while the
POSTROUTING chain is traversed by all packets, including those routed from somewhere else.
There are two subcases for network address translation (NAT): SNAT translates the source address of the packet, while DNAT translates the destination address of the packet.
You are restricted in which chains you can do either:
nat/OUTPUT can do DNAT, while
nat/POSTROUTING and possibly
nat/INPUT (not sure if this still works) can do SNAT.
@ x-yuri I was also confused about output NAT but finally I got the answer. Prerouting & Postrouting NAT are both for external NAT when some packets are coming to your interface or going out of it and you wanna NAT the address. But OUTPUT NAT is for your local network NAT, I mean when the packets are starting from your application. I think this is a good example to figure it out better. When you wanna change the port and IP address of a traffic as a transparent proxy such as what we do in Nginx. We can use something like this:
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.100.10:8080
you send traffic on port 80 to the other host on your network 192.168.100.10 which is listening on it's port 8080
I think it's the point I hope it is true and what you were asking for