One-to-one NAT — 1:1 static NAT, both directions, no conntrack asymmetry

1:1 NAT (also called static NAT or 1:1 mapping) maps a public IP address to a private IP address, with every port forwarded. The private host appears to have the public IP for all services.

The 1:1 NAT pattern is the production default for:

• Exposing multiple services on a single host — the host has a web server, mail server, and SSH; each is reachable on the public IP.
• Hosting a server with a known public IP — the server’s certificate is bound to the public IP; 1:1 NAT preserves the public IP for all connections.
• Outbound traffic from a server — the server’s outbound traffic appears to come from the public IP (consistent identity for whitelisting).

This lesson covers the 1:1 NAT configuration, the bidirectional translation, the routing requirement, the difference from port forwarding, and the production failure modes.

Configuring 1:1 NAT

1:1 NAT is composed of two NAT rules:

1. DNAT rule — rewrites the destination of inbound traffic from the public IP to the private IP.
2. SNAT rule — rewrites the source of outbound traffic from the private IP to the public IP.

# DNAT for inbound traffic
set nat destination rule 10 inbound-interface name eth0
set nat destination rule 10 destination address 203.0.113.10
set nat destination rule 10 translation address 192.168.1.100

# SNAT for outbound traffic
set nat source rule 10 outbound-interface name eth1
set nat source rule 10 source address 192.168.1.100
set nat source rule 10 translation address 203.0.113.10

commit

The two rules are complementary:

• The DNAT rule maps the public IP (203.0.113.10) to the private IP (192.168.1.100) for inbound traffic.
• The SNAT rule maps the private IP (192.168.1.100) back to the public IP (203.0.113.10) for outbound traffic.

The two rules are typically at the same sequence number because they are conceptually a single mapping.

The conntrack entries

The conntrack table has two entries for 1:1 NAT traffic (one per direction):

# Inbound (Internet client -> public IP)
tcp 6 300 ESTABLISHED src=198.51.100.5 dst=203.0.113.10
  sport=52012 dport=443 packets=12 bytes=1844 [ASSURED]
  src=192.168.1.100 dst=198.51.100.5 sport=443 dport=52012
  packets=8 bytes=4096

# Outbound (private host -> Internet)
tcp 6 300 ESTABLISHED src=192.168.1.100 dst=198.51.100.5
  sport=52012 dport=443 packets=12 bytes=1844 [ASSURED]
  src=198.51.100.5 dst=203.0.113.10 sport=443 dport=52012
  packets=8 bytes=4096

The two entries are linked by the conntrack table: an outbound flow from 192.168.1.100 has the reply direction with dst=203.0.113.10; an inbound flow to 203.0.113.10 has the reply direction with dst=192.168.1.100. The conntrack table ties the two together.

The routing requirement

The 1:1 NAT pattern requires the private host’s default gateway to be the router. The host’s outbound traffic must go through the router so the SNAT rule can rewrite the source.

flowchart LR
  P["Private host<br/>192.168.1.100"]
  R["Router<br/>eth1=192.168.1.1<br/>eth0=203.0.113.10"]
  N["Internet<br/>198.51.100.5"]

  P -->|"outbound: src=192.168.1.100"| R
  R -->|"SNAT: src=203.0.113.10"| N
  N -->|"reply: dst=203.0.113.10"| R
  R -->|"DNAT: dst=192.168.1.100"| P

If the host’s default gateway is not the router, the outbound traffic does not pass through the router; the SNAT rule is not applied; the outbound traffic reaches the Internet with the private IP as the source. The Internet server cannot reply (the private IP is not routable). The connection fails.

1:1 NAT vs port forwarding

The two patterns have different use cases:

Port forwarding maps one external port to one internal port (or port range). 1:1 NAT maps all ports.

The choice depends on the deployment:

• Single service — port forwarding is sufficient.
• Multiple services on one host — 1:1 NAT is more efficient (one rule for all services).
• Host needs a stable public IP — 1:1 NAT (the host is reachable on the public IP for all services).
• Server with strict outbound identity — 1:1 NAT (the host always appears as the public IP).

Multiple public IPs

The 1:1 NAT pattern can map multiple public IPs to multiple private hosts:

# Public IP 203.0.113.10 -> 192.168.1.100
set nat destination rule 10 inbound-interface name eth0
set nat destination rule 10 destination address 203.0.113.10
set nat destination rule 10 translation address 192.168.1.100

set nat source rule 10 outbound-interface name eth1
set nat source rule 10 source address 192.168.1.100
set nat source rule 10 translation address 203.0.113.10

# Public IP 203.0.113.11 -> 192.168.1.101
set nat destination rule 11 inbound-interface name eth0
set nat destination rule 11 destination address 203.0.113.11
set nat destination rule 11 translation address 192.168.1.101

set nat source rule 11 outbound-interface name eth1
set nat source rule 11 source address 192.168.1.101
set nat source rule 11 translation address 203.0.113.11

commit

Each host gets its own public IP. The router’s WAN interface must have both public IPs assigned (or secondary addresses).

Production failure modes

The five production failure modes the operator must recognise:

1. Wrong host default gateway — the host’s gateway is not the router. The SNAT rule is not applied; outbound traffic fails.
2. Missing firewall rule — the firewall blocks the post-NAT traffic on the LAN interface. The inbound traffic is silently dropped.
3. Asymmetric routing — the inbound traffic goes through the router but the outbound traffic does not. The conntrack entry is created for inbound; the outbound traffic does not match.
4. Stale conntrack entry — the 1:1 mapping is changed (e.g., the public IP is moved to a new host) but existing flows still have the old conntrack entry.
5. Missing secondary IP — the router’s WAN interface does not have the public IP assigned. The inbound traffic is not routed to the router.

Operational commands

The 1:1 NAT state is exercised through the standard VyOS operational commands:

# Show the NAT rules
show nat destination
show nat source

# Show the WAN interface addresses
show interfaces ethernet eth0
sudo ip addr show eth0

# Show the conntrack entries
sudo conntrack -L
sudo conntrack -L -n

# Show the routing table
show ip route

# Live packet capture
sudo tcpdump -ni eth0 'host 203.0.113.10'
sudo tcpdump -ni eth1 'host 192.168.1.100'

# Flush the conntrack table (after NAT changes)
sudo conntrack -F

Rollback

The 1:1 NAT changes are rolled back the same way as any VyOS configuration change:

# Show the candidate diff
compare

# Revert to a previous revision
rollback 1
commit
save

# Or delete the rule and re-commit
delete nat destination rule 10
delete nat source rule 10
commit
save

# Flush the conntrack table
sudo conntrack -F

The discipline: every 1:1 NAT change is followed by a conntrack flush.

Production discipline

Cross-course references

• Part XXXVIII-01 (XXXVIII-VyOS-NAT / SNAT vs DNAT concept) covers the underlying NAT primitives.
• Part XXXVIII-03 (XXXVIII-VyOS-NAT / port forwarding) covers the single-service exposure pattern.
• Part XXXVII-05 (XXXVII-VyOS-Firewall / default deny) covers the firewall rules that permit post-NAT traffic.
• Part XXXVIII-06 (XXXVIII-VyOS-NAT / NAT troubleshoot) covers the diagnostic method.

Quiz