Page 1 of 1

How exactly this works? dstnat to external ip

Posted: Sun Sep 29, 2019 6:27 pm
by shivansps
This is something i did not realised that can be done. My friends and i were playing in a Arma 3 server a few days ago, and 3 of them had problems conecting to the server due to very high packet loss, so out of the "im out of ideas lets try this" i did a firewall rule to dstnat all the ports needed to the server IP and they conected to my ip instead of the server. To my suprise this worked, and perfectly.

I never had time to check but how this works? I suspect that by doing this the router acts as a "proxy": Client<->My Router<->Server. It is like this?

Re: How exactly this works? dstnat to external ip

Posted: Sun Sep 29, 2019 6:43 pm
by Zacharias
You configured the clients with your public IP?
Then you created a dst-nat on your router?
Do i understand correctly?
Can i see that dst-nat rule?

Re: How exactly this works? dstnat to external ip

Posted: Sun Sep 29, 2019 6:47 pm
by Sob
It's simple, dstnat changes destination address, so when they connect to you, their packets are redirected to target server. And since you also have srcnat/masquerade on WAN interface, and it's clearly not limited only to connection from your LAN, you created a variant of hairpin NAT config. So from server's perspective, their connections are coming from you, so server responds back to you, connection tracking on your router deals with it and correctly forward responses back to clients.

Re: How exactly this works? dstnat to external ip

Posted: Sun Sep 29, 2019 9:55 pm
by shivansps
It's simple, dstnat changes destination address, so when they connect to you, their packets are redirected to target server. And since you also have srcnat/masquerade on WAN interface, and it's clearly not limited only to connection from your LAN, you created a variant of hairpin NAT config. So from server's perspective, their connections are coming from you, so server responds back to you, connection tracking on your router deals with it and correctly forward responses back to clients.
Interesting i did not realised it was so easy to create a "relay" like this, thank you.