Both SNAT and DNAT do address translation both for incoming and outgoing packages, using the connection tracking (conntrack
) facility of the kernel. So if the kernel detects that a packet in the reverse direction belongs to a NATed connection, it will do the reverse translation automatically, without a special rule for it.
That's why e.g. a single SNAT rule is enough (though it doesn't hurt if you have a DNAT rule for the other direction).
And yes, MASQUERADE is basically SNAT with the address taken from the interface. To quote man iptables-extensions
:
Masquerading is equivalent to specifying a mapping to the IP address of
the interface the packet is going out, but also has the effect that
connections are forgotten when the interface goes down.
BTW, I find it simpler to remember that SNAT = Source NAT (changes the source address of the packet), and DNAT = Destination NAT (changes the destination address of the packet).
Edit
(Normally, you should ask new questions as a separate question).
netstat
only shows connections between applications running on the local computer, and other hosts. It doesn't show the kernel connection tracking, you can find information about this in /proc
(e.g. /proc/net/nf_conntrack
) of with additional utilities from the conntrack
package.
The networking layer doesn't know anything about "users". A connection consists of the source address, the source port, the destination address, and the destination port. That's all the networking layer knows about. It does NAT (Network Address Translation) by replacing the source/destination address, and also by replacing the destination/source (i.e., local) port number with some other number if that port is already in use.
So two users on different hosts with identical ports (on their machine) that are noth NATed will get different ports on the NATing host. Two users on the same machine will always use different local ports in the first place, so that is never a problem. The same if one user opens two connections at once.