What is DNAT?

Destination NAT (DNAT) rewrites the destination IP address – and optionally the destination port – of inbound packets, then reverses that translation on the replies. It is the mechanism that lets a server on a private network, such as a web server in a DMZ, be reached through a public IP address without exposing its real, internal address.

Key takeaways

• DNAT rewrites the destination IP and port of inbound packets.
• It exposes a privately addressed server to the public internet.
• Port forwarding is a simplified, single-service form of DNAT.
• Twice NAT combines DNAT with source NAT in one translation rule.
• Versa VOS configures DNAT through CGNAT pools and translation rules.

On this page: Why it matters · How it works · Types · DNAT & Versa · FAQ

Why is DNAT important?

Many organizations run internal servers – web front ends, mail relays, application backends – on private, non-routable addresses, but still need specific services reachable from the internet or partner networks. Routing a public address straight to an internal host would expose the network’s real addressing. DNAT solves this: a gateway advertises a public IP address, rewrites the destination of matching connections to the real server’s private address, and reverses that rewrite on the way out, so the internal host’s address is never visible externally.

Because only the destination fields change, nothing upstream of the NAT device needs to know the internal topology. This is the pattern behind home-router “port forwarding” and enterprise DMZ designs alike, and it scales up to carrier-grade NAT deployments that give many services a public presence from a constrained address pool.

What is DNAT?

A DNAT device intercepts inbound packets addressed to a public IP address and port, and rewrites the destination fields to the real server’s private IP address and port before forwarding the packet on. State is kept per flow, so reply packets – carrying the private address as their source – get the inverse translation before reaching the client. The connection appears, from the client’s view, to terminate on the public address; the server only sees translated headers.

The published port and the port the server listens on don’t have to match – DNAT can map a nonstandard external port to a standard internal one, useful for flexibility and light obscurity. DNAT is the inverse of source NAT (SNAT), which rewrites outbound packets’ source address so many hosts share a smaller pool of public addresses; the two are often combined in one rule (“twice NAT”) when both directions need translation.

Types of DNAT

Static DNAT maps one public IP address, and optionally a port range, to one private IP address on a fixed, one-to-one basis – the standard pattern for publishing a single server. Port forwarding is a simplified case of the same mechanism, scoped to one WAN connection, address, and port range, for exposing a single service without a full rule set. Dynamic DNAT allocates the destination address from a pool instead of a fixed mapping; VOS uses this for network obfuscation, where the address a DNS client is told to use is dynamically bound to, and different from, the server’s real address. Twice NAT performs DNAT and source NAT within one rule, translating both addresses of a flow at once – useful when the internal and external address spaces would otherwise overlap.

DNAT & Versa

VOS configures Destination NAT as part of CGNAT, from Configuration > Services > CGNAT in Director or Configure > Secure SD-WAN > Network Services > CGNAT Policies in Concerto – see Configure CGNAT and Configure CGNAT Policies. A CGNAT pool holds the real private addresses of hosts behind the DMZ; a rule matches inbound traffic and applies Destination NAT-44 or Port Forwarding (a simplified shortcut), while VOS handles the reverse translation automatically.

Configuring and Verifying Destination NAT walks through an example: a user reaches a web server’s public IP on port 8080, and the VOS CPE translates the session to the server’s real address on port 80, visible in the CLI NAT session table and the Director Monitor tab. Later releases add dynamic DNAT for network obfuscation, paired with a DNS proxy that answers client lookups from the dynamic pool.

Frequently asked questions

What is the difference between DNAT and SNAT?

DNAT rewrites the destination address of inbound packets, typically to expose an internal server publicly. SNAT rewrites the source address of outbound packets, so multiple hosts can share a smaller pool of public addresses. Both reverse the translation on return traffic.

What is the difference between DNAT and port forwarding?

Port forwarding is a simplified configuration of DNAT, scoped to a single WAN connection, address, and port range, meant for exposing one service quickly. Full Destination NAT-44 rules support broader match criteria, translated destination pools, and reuse across many services.

Does DNAT translate the port as well as the IP address?

Yes, optionally. DNAT can rewrite only the destination IP address, or the IP address and port together, which lets a service published on one external port be forwarded to a different port the internal server listens on – VOS handles the forwarding automatically.

How does Versa VOS verify a DNAT translation?

VOS shows active NAT sessions from the CLI, listing the external IP:port a client connected to alongside the internal IP:port it was translated to. The same sessions are visible from the Monitor tab in Versa Director, useful for confirming a rule works as intended.

What is dynamic DNAT used for in Versa CGNAT?

Dynamic DNAT allocates the destination address from a pool rather than a fixed mapping. Versa uses it for network obfuscation, where the address a DNS client resolves differs from, and is dynamically bound to, the server’s actual address for that session.

More on DNAT

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DNAT, these are worth looking at next.