A little doubt about MASQUERADE and SNAT/DNAT

Question

I know what SNAT and DNAT means. And I know when I want to config a local net server open service to internet, I should use:

• SNAT to help to change the packets coming from local net server to the router's address.
• DNAT to help to change the packets coming from internet to the local net ip of the server

But when we share network using MASQUERADE, we don't need to config the DNAT for these packets coming from internet. Some articles says the MASQUERADE is the same as SNAT except for auto find router's external ip.But why MASQUERADE doesn't need the DNAT configuration? And suppose MASUQERADE can do these thing for us, why iptables doesn't auto set SNAT for us when we set DNAT?

Edit

I just have a new question. Suppose two user in the local net browsing the same web page, and the clients ports that they opened is the same. When the web page server response packages to the router, how does the router know the packages is belonged to which user?

Answer 1

Both SNAT and DNAT do address translation both for incoming and outgoing packages, using the connection tracking (conntrack) facility of the kernel. So if the kernel detects that a packet in the reverse direction belongs to a NATed connection, it will do the reverse translation automatically, without a special rule for it.

That's why e.g. a single SNAT rule is enough (though it doesn't hurt if you have a DNAT rule for the other direction).

And yes, MASQUERADE is basically SNAT with the address taken from the interface. To quote man iptables-extensions:

Masquerading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down.

BTW, I find it simpler to remember that SNAT = Source NAT (changes the source address of the packet), and DNAT = Destination NAT (changes the destination address of the packet).

Edit

(Normally, you should ask new questions as a separate question).

netstat only shows connections between applications running on the local computer, and other hosts. It doesn't show the kernel connection tracking, you can find information about this in /proc (e.g. /proc/net/nf_conntrack) of with additional utilities from the conntrack package.

The networking layer doesn't know anything about "users". A connection consists of the source address, the source port, the destination address, and the destination port. That's all the networking layer knows about. It does NAT (Network Address Translation) by replacing the source/destination address, and also by replacing the destination/source (i.e., local) port number with some other number if that port is already in use.

So two users on different hosts with identical ports (on their machine) that are noth NATed will get different ports on the NATing host. Two users on the same machine will always use different local ports in the first place, so that is never a problem. The same if one user opens two connections at once.