Command by command
| Cisco IOS | Linux | What it gives you |
|---|---|---|
show ip nat translations | conntrack -L | Live translations |
show ip nat statistics | conntrack -C | Count of tracked connections |
show running-config | include ip nat | iptables -t nat -L -n -v | The NAT rules themselves |
clear ip nat translation * | conntrack -F | Flush the table |
| conntrack -E | Watch translations live as they are created |
What the output looks like
$ iptables -t nat -L POSTROUTING -n -v
Chain POSTROUTING (policy ACCEPT 3 packets, 252 bytes)
pkts bytes target prot opt in out source destination
24 2016 SNAT 0 -- * ge1 192.168.1.0/24 0.0.0.0/0 to:203.0.113.1
$ conntrack -L
tcp 6 431999 ESTABLISHED src=192.168.1.10 dst=203.0.113.50 sport=54321 dport=80 \
src=203.0.113.50 dst=203.0.113.1 sport=80 dport=54321 [ASSURED] mark=0 use=1Why the two differ
IOS presents NAT as its own feature with its own translation table. Linux implements NAT on top of connection tracking: the first packet of a flow is matched against the NAT rules, a translation is chosen and recorded in the conntrack entry, and every subsequent packet of that flow is translated from the conntrack entry without consulting the rules again. That is why the two views exist, and why editing a NAT rule does not affect connections that are already open — their translation was decided when the flow started.
The trap
Each conntrack line shows the flow twice: the original direction first, then the expected reply. Reading the second tuple as a separate connection is the standard mistake. In the example above there is one connection, and the reply tuple shows the post-NAT addresses — which is precisely the information you need to confirm the translation is what you intended.
Common questions
Why is conntrack not installed?
It is a separate package, conntrack-tools, and is not part of a base install on most distributions. Without it, a kernel built with the older procfs interface still exposes the raw table at /proc/net/nf_conntrack, which contains the same information in a less readable form.
What is the difference between MASQUERADE and SNAT?
Both rewrite the source address. SNAT takes a fixed address you specify; MASQUERADE looks up the outgoing interface's current address for every flow, which costs a little more but is correct when that address is assigned dynamically. Use SNAT on a static uplink, MASQUERADE on a dynamic one.
Stop reading, start running
Open the lab, go live, and run iptables -t nat -L -n -v against real Linux networking in your browser. No install, no signup.