iptables中DNAT与SNAT的理解
January 12th, 2009 Posted in LinuxDNAT（Destination Network Address Translation,目的地址转换) 通常被叫做目的映谢。而SNAT（Source Network Address Translation，源地址转换）通常被叫做源映谢。
这是我们在设置Linux网关或者防火墙时经常要用来的两种方式。以前对这两个都解释得不太清楚，现在我在这里解释一下。
首先，我们要了解一下IP包的结构，如下图所示：
在任何一个IP数据包中，都会有Source IP Address与Destination IP Address这两个字段，数据包所经过的路由器也是根据这两个字段是判定数据包是由什么地方发过来的，它要将数据包发到什么地方去。而iptables的DNAT与SNAT就是根据这个原理，对Source IP Address与Destination IP Address进行修改。
然后，我们再看看数据包在iptables中要经过的链（chain）：
图中正菱形的区域是对数据包进行判定转发的地方。在这里，系统会根据IP数据包中的destination ip address中的IP地址对数据包进行分发。如果destination ip adress是本机地址，数据将会被转交给INPUT链。如果不是本机地址，则交给FORWARD链检测。
这也就是说，我们要做的DNAT要在进入这个菱形转发区域之前，也就是在PREROUTING链中做，比如我们要把访问202.103.96.112的访问转发到192.168.0.112上：
这个转换过程当中，其实就是将已经达到这台Linux网关（防火墙）上的数据包上的destination ip address从202.103.96.112修改为192.168.0.112然后交给系统路由进行转发。
而SNAT自然是要在数据包流出这台机器之前的最后一个链也就是POSTROUTING链来进行操作
这个语句就是告诉系统把即将要流出本机的数据的source ip address修改成为58.20.51.66。这样，数据包在达到目的机器以后，目的机器会将包返回到58.20.51.66也就是本机。如果不做这个操作，那么你的数据包在传递的过程中，reply的包肯定会丢失。
22 Responses to “iptables中DNAT与SNAT的理解”
By sealinger on Apr 8, 2009
老兄，讲的太好了！深入浅出，受益匪浅！
By myhnet on Apr 9, 2009
呵呵，听懂了就好。
🙂
By linux fan on Apr 15, 2009
能否同时对源与目标都进行转换
By myhnet on Apr 15, 2009
同时？
看明白这个图之后，就没有所谓的同时。
在prerouting链里面做不了SNAT，postrouting链里面做不了DNAT
做了也没有用
By mylinux on May 15, 2009
你说的好像都是包出去的时候iptables做的动作 能给分析包进来的时候包做的动作吗
好象包回来的时候 prerouting和postrouting位置换了吧？请教！
By mylinux on May 15, 2009
最好举个例子说明一下包出去和回来的地址变化情况
非常感谢
By myhnet on May 15, 2009
当一个数据包进入linux系统以后，首先进入mangle表的prerouting链，进行某些预路由的修改（也可能不改），然后数据包进入nat表的 prerouting链，进行dnat之类（改变数据包的目的地址，比如我们所说的网关，比如从外网返回的数据包并不知道是内网的哪台机器需要这个数据包，都发给了网关的外网地址，而网关就要把这些数据包的目的地址改为正确的目的地址，而不是自己）的事情，然后进行判断这个数据包是发给这台计算机自身的还是仅仅需要转发的。如果是转发，就发送给mangle表的FORWARD链，进行一些参数修改（比如tos什么的参数）或者不修改，然后送给 filter表的forward链进行过滤（就是通常所说的转发过滤规则），然后送给mangle表的postrouting链进行进一步的参数修改（或者不修改），然后发给nat表的postrouting链修改（或者不修改）源地址（比如网关这个时候会把本来发自内网ip的数据包的源地址改为自己的外网IP，这样发送出去后，外面的主机就会以为这是网关发出的数据包了），然后发给网卡设备发送到网上。
By geraint on Sep 15, 2009
静态地址映射怎么回事？能解释下吗？
By jianghao on Oct 18, 2009
input —对进入本机的数据进行过滤
output —-对从本机出去的数据进行处理
forward—– 对本网段的数据进行处理
prerouting —— dnat 和 ports redirect
postrouting ——-snat 和 masquerade
iptables 其实 只有两条chains 是对本机有用的 input 和 output
而 forwad 其实是用来处理局域网中的数据包的（因为linux一般是用来充当网关或者是路由器的）
而 prerouting 和 postrouting 属于nat 表，这个 —其实是iptables的附加功能，主要是用来做翻译的，
right？？？
By myhnet on Oct 19, 2009
是的，理解正确
By 祥哥哥 on Apr 19, 2010
博主的文章 很不错。 可否交个友情链接。 贵站链接也做好
By myhnet on Apr 19, 2010
好啊。你链接呢？
By ferity on Jun 2, 2010
谢谢博主咯“` ^_^ 让我多了解了一些东西`
By iptables advance tips on Sep 2, 2010
learn!
By yuly on Feb 28, 2011
iptable链的图是用什么工具画的？很漂亮啊
By hkl on Jul 26, 2011
共同学习
By xiao on Oct 24, 2011
写的很好，消除了我一些疑问 十分感谢! 11楼问出了我疑问，图用什么软件画的？
By Havent on May 16, 2012
我有个疑问，我这里环境中使用OpenStack组件（Nova+Quantum+Openvswitch）在物理主机上创建虚拟机，创建了虚拟机后，在iptables中产生了一条记录（创建虚拟机的网段是192.168.208.0/24）：
执行iptables-save命令以后：
-A nova-manage-snat -s 192.168.208.0/24 -j SNAT –to-source 10.131.0.244
创建的虚拟机的地址是192.168.208.2
由于有上面的那条记录，我连接不上192.168.208.2这个地址，但是当我把这一条去掉，或者随便将192.168.208.0改成别的（比如192.168.209.0），就可以连接192.168.208.2这个地址并且成功登录虚拟机，不知道这是怎么回事？能使用SNAT的原理解释通吗？谢谢！
附我的iptables-save命令执行结果如下：
# iptables-save
# Generated by iptables-save v1.4.12 on Wed May 16 15:51:01 2012
*mangle
:PREROUTING ACCEPT [15046:9019157]
:INPUT ACCEPT [13736:8589477]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [12798:8326770]
:POSTROUTING ACCEPT [12798:8326770]
-A POSTROUTING -o virbr0 -p udp -m udp –dport 68 -j CHECKSUM –checksum-fill
COMMIT
# Completed on Wed May 16 15:51:01 2012
# Generated by iptables-save v1.4.12 on Wed May 16 15:51:01 2012
*nat
:PREROUTING ACCEPT [752:243805]
:INPUT ACCEPT [190:59469]
:OUTPUT ACCEPT [3:204]
:POSTROUTING ACCEPT [2:120]
:nova-api-OUTPUT – [0:0]
:nova-api-POSTROUTING – [0:0]
:nova-api-PREROUTING – [0:0]
:nova-api-float-snat – [0:0]
:nova-api-snat – [0:0]
:nova-compute-OUTPUT – [0:0]
:nova-compute-POSTROUTING – [0:0]
:nova-compute-PREROUTING – [0:0]
:nova-compute-float-snat – [0:0]
:nova-compute-snat – [0:0]
:nova-manage-OUTPUT – [0:0]
:nova-manage-POSTROUTING – [0:0]
:nova-manage-PREROUTING – [0:0]
:nova-manage-float-snat – [0:0]
:nova-manage-snat – [0:0]
:nova-network-OUTPUT – [0:0]
:nova-network-POSTROUTING – [0:0]
:nova-network-PREROUTING – [0:0]
:nova-network-float-snat – [0:0]
:nova-network-snat – [0:0]
:nova-postrouting-bottom – [0:0]
-A PREROUTING -j nova-compute-PREROUTING
-A PREROUTING -j nova-network-PREROUTING
-A PREROUTING -j nova-manage-PREROUTING
-A PREROUTING -j nova-api-PREROUTING
-A OUTPUT -j nova-compute-OUTPUT
-A OUTPUT -j nova-network-OUTPUT
-A OUTPUT -j nova-manage-OUTPUT
-A OUTPUT -j nova-api-OUTPUT
-A POSTROUTING -j nova-compute-POSTROUTING
-A POSTROUTING -j nova-network-POSTROUTING
-A POSTROUTING -j nova-manage-POSTROUTING
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE –to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE –to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
-A POSTROUTING -j nova-api-POSTROUTING
-A POSTROUTING -j nova-postrouting-bottom
-A nova-api-snat -j nova-api-float-snat
-A nova-compute-snat -j nova-compute-float-snat
-A nova-manage-snat -j nova-manage-float-snat
-A nova-manage-snat -s 192.168.208.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-POSTROUTING -s 192.168.200.0/24 -d 10.131.0.244/32 -j ACCEPT
-A nova-network-POSTROUTING -s 192.168.200.0/24 -d 10.128.0.0/24 -j ACCEPT
-A nova-network-POSTROUTING -s 192.168.200.0/24 -d 192.168.200.0/24 -m conntrack ! –ctstate DNAT -j ACCEPT
-A nova-network-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp –dport 80 -j DNAT –to-destination 10.131.0.244:8775
-A nova-network-snat -j nova-network-float-snat
-A nova-network-snat -s 192.168.200.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 8.8.8.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 7.7.7.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 9.9.9.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 192.168.201.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 192.168.202.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 192.168.203.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 192.168.204.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 192.168.205.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 6.6.6.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 5.5.5.0/24 -j SNAT –to-source 10.131.0.244
-A nova-network-snat -s 18.18.18.0/24 -j SNAT –to-source 10.131.0.244
-A nova-postrouting-bottom -j nova-compute-snat
-A nova-postrouting-bottom -j nova-network-snat
-A nova-postrouting-bottom -j nova-manage-snat
-A nova-postrouting-bottom -j nova-api-snat
COMMIT
# Completed on Wed May 16 15:51:01 2012
# Generated by iptables-save v1.4.12 on Wed May 16 15:51:01 2012
*filter
:INPUT ACCEPT [12873:8306413]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [12641:8273688]
:nova-api-FORWARD – [0:0]
:nova-api-INPUT – [0:0]
:nova-api-OUTPUT – [0:0]
:nova-api-local – [0:0]
:nova-compute-FORWARD – [0:0]
:nova-compute-INPUT – [0:0]
:nova-compute-OUTPUT – [0:0]
:nova-compute-inst-54 – [0:0]
:nova-compute-inst-55 – [0:0]
:nova-compute-inst-56 – [0:0]
:nova-compute-inst-57 – [0:0]
:nova-compute-inst-58 – [0:0]
:nova-compute-inst-59 – [0:0]
:nova-compute-inst-60 – [0:0]
:nova-compute-local – [0:0]
:nova-compute-provider – [0:0]
:nova-compute-sg-fallback – [0:0]
:nova-filter-top – [0:0]
:nova-manage-FORWARD – [0:0]
:nova-manage-INPUT – [0:0]
:nova-manage-OUTPUT – [0:0]
:nova-manage-local – [0:0]
:nova-network-FORWARD – [0:0]
:nova-network-INPUT – [0:0]
:nova-network-OUTPUT – [0:0]
:nova-network-local – [0:0]
-A INPUT -j nova-compute-INPUT
-A INPUT -j nova-network-INPUT
-A INPUT -j nova-manage-INPUT
-A INPUT -i virbr0 -p udp -m udp –dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp –dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp –dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp –dport 67 -j ACCEPT
-A INPUT -j nova-api-INPUT
-A INPUT -p gre -j ACCEPT
-A FORWARD -j nova-filter-top
-A FORWARD -j nova-compute-FORWARD
-A FORWARD -j nova-network-FORWARD
-A FORWARD -j nova-manage-FORWARD
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT –reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT –reject-with icmp-port-unreachable
-A FORWARD -j nova-api-FORWARD
-A OUTPUT -j nova-filter-top
-A OUTPUT -j nova-compute-OUTPUT
-A OUTPUT -j nova-network-OUTPUT
-A OUTPUT -j nova-manage-OUTPUT
-A OUTPUT -j nova-api-OUTPUT
-A nova-api-INPUT -d 10.131.0.244/32 -p tcp -m tcp –dport 8775 -j ACCEPT
-A nova-compute-inst-54 -m state –state INVALID -j DROP
-A nova-compute-inst-54 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-54 -j nova-compute-provider
-A nova-compute-inst-54 -s 8.8.8.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-54 -s 9.9.9.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-54 -s 8.8.8.0/24 -j ACCEPT
-A nova-compute-inst-54 -s 9.9.9.0/24 -j ACCEPT
-A nova-compute-inst-54 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-54 -j nova-compute-sg-fallback
-A nova-compute-inst-55 -m state –state INVALID -j DROP
-A nova-compute-inst-55 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-55 -j nova-compute-provider
-A nova-compute-inst-55 -s 9.9.9.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-55 -s 8.8.8.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-55 -s 9.9.9.0/24 -j ACCEPT
-A nova-compute-inst-55 -s 8.8.8.0/24 -j ACCEPT
-A nova-compute-inst-55 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-55 -j nova-compute-sg-fallback
-A nova-compute-inst-56 -m state –state INVALID -j DROP
-A nova-compute-inst-56 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-56 -j nova-compute-provider
-A nova-compute-inst-56 -s 8.8.8.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-56 -s 192.168.201.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-56 -s 8.8.8.0/24 -j ACCEPT
-A nova-compute-inst-56 -s 192.168.201.0/24 -j ACCEPT
-A nova-compute-inst-56 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-56 -j nova-compute-sg-fallback
-A nova-compute-inst-57 -m state –state INVALID -j DROP
-A nova-compute-inst-57 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-57 -j nova-compute-provider
-A nova-compute-inst-57 -s 9.9.9.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-57 -s 8.8.8.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-57 -s 9.9.9.0/24 -j ACCEPT
-A nova-compute-inst-57 -s 8.8.8.0/24 -j ACCEPT
-A nova-compute-inst-57 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-57 -j nova-compute-sg-fallback
-A nova-compute-inst-58 -m state –state INVALID -j DROP
-A nova-compute-inst-58 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-58 -j nova-compute-provider
-A nova-compute-inst-58 -s 9.9.9.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-58 -s 192.168.206.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-58 -s 9.9.9.0/24 -j ACCEPT
-A nova-compute-inst-58 -s 192.168.206.0/24 -j ACCEPT
-A nova-compute-inst-58 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-58 -j nova-compute-sg-fallback
-A nova-compute-inst-59 -m state –state INVALID -j DROP
-A nova-compute-inst-59 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-59 -j nova-compute-provider
-A nova-compute-inst-59 -s 9.9.9.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-59 -s 192.168.207.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-59 -s 9.9.9.0/24 -j ACCEPT
-A nova-compute-inst-59 -s 192.168.207.0/24 -j ACCEPT
-A nova-compute-inst-59 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-59 -j nova-compute-sg-fallback
-A nova-compute-inst-60 -m state –state INVALID -j DROP
-A nova-compute-inst-60 -m state –state RELATED,ESTABLISHED -j ACCEPT
-A nova-compute-inst-60 -j nova-compute-provider
-A nova-compute-inst-60 -s 8.8.8.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-60 -s 192.168.208.1/32 -p udp -m udp –sport 67 –dport 68 -j ACCEPT
-A nova-compute-inst-60 -s 8.8.8.0/24 -j ACCEPT
-A nova-compute-inst-60 -s 192.168.208.0/24 -j ACCEPT
-A nova-compute-inst-60 -p tcp -m tcp –dport 22 -j ACCEPT
-A nova-compute-inst-60 -j nova-compute-sg-fallback
-A nova-compute-local -d 8.8.8.6/32 -j nova-compute-inst-54
-A nova-compute-local -d 9.9.9.3/32 -j nova-compute-inst-54
-A nova-compute-local -d 9.9.9.4/32 -j nova-compute-inst-55
-A nova-compute-local -d 8.8.8.7/32 -j nova-compute-inst-55
-A nova-compute-local -d 8.8.8.8/32 -j nova-compute-inst-56
-A nova-compute-local -d 192.168.201.2/32 -j nova-compute-inst-56
-A nova-compute-local -d 9.9.9.5/32 -j nova-compute-inst-57
-A nova-compute-local -d 8.8.8.9/32 -j nova-compute-inst-57
-A nova-compute-local -d 9.9.9.6/32 -j nova-compute-inst-58
-A nova-compute-local -d 192.168.206.2/32 -j nova-compute-inst-58
-A nova-compute-local -d 9.9.9.7/32 -j nova-compute-inst-59
-A nova-compute-local -d 192.168.207.2/32 -j nova-compute-inst-59
-A nova-compute-local -d 8.8.8.10/32 -j nova-compute-inst-60
-A nova-compute-local -d 192.168.208.2/32 -j nova-compute-inst-60
-A nova-compute-sg-fallback -j DROP
-A nova-filter-top -j nova-compute-local
-A nova-filter-top -j nova-network-local
-A nova-filter-top -j nova-manage-local
-A nova-filter-top -j nova-api-local
-A nova-network-FORWARD -i br-int -j ACCEPT
-A nova-network-FORWARD -o br-int -j ACCEPT
-A nova-network-INPUT -i gw-50c4308f-34 -p udp -m udp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-50c4308f-34 -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-50c4308f-34 -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-50c4308f-34 -p tcp -m tcp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-5bfd9bfa-d6 -p udp -m udp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-5bfd9bfa-d6 -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-5bfd9bfa-d6 -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-5bfd9bfa-d6 -p tcp -m tcp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-23abd98f-03 -p udp -m udp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-23abd98f-03 -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-23abd98f-03 -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-23abd98f-03 -p tcp -m tcp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-7c3078e0-e6 -p udp -m udp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-7c3078e0-e6 -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-7c3078e0-e6 -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-7c3078e0-e6 -p tcp -m tcp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-ec8a468b-ea -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-ec8a468b-ea -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-ec8a468b-ea -p tcp -m tcp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-3d604d8e-b8 -p udp -m udp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-3d604d8e-b8 -p tcp -m tcp –dport 67 -j ACCEPT
-A nova-network-INPUT -i gw-3d604d8e-b8 -p udp -m udp –dport 53 -j ACCEPT
-A nova-network-INPUT -i gw-3d604d8e-b8 -p tcp -m tcp –dport 53 -j ACCEPT
COMMIT
# Completed on Wed May 16 15:51:01 2012
By myhnet on Jun 12, 2012
这个是正常的。看看包trace的状态吧。我估计 10.131.0.244 怕个地址在你的网络中有点特殊。跟SNAT没太大关系。
By Jefferry on Mar 30, 2013
请问一下那个VMware能配置四种nat类型么，就是源地址的端口多种变化
By zc on Apr 9, 2013
请教一下，在路由器上做了SNAT之后，在路由器下的一台主机上发送数据包出去之后，比如说ping外网的一个主机，在postrouting链时会将数据包中的源ip改成路由器的wan口地址，此时在路由器中会将主机ip与路由器wan口ip之间的映射保存在哪里？因为，当外网主机的reply包过来的时候目的ip是路由器的wan口ip，路由器是会根据之前的那条映射转发给主机吧，现在的问题是那条映射存放在哪，怎么找？
By myhnet on Apr 30, 2013
TCP/IP包本身里面肯定记录了相关的信息，不然怎么能标记related？具体建议你看看TCP/IP协议。