SNAT

networkingvendors & products

Stands for: source network address translation

Rewriting the client source address as traffic passes through a device.

Source network address translation makes connections appear to originate from the device's address rather than the client's. On BIG-IP it ensures return traffic comes back through the proxy, at the cost of hiding the original client IP from the server.

SNAT rewrites the source address of traffic as it passes through a device, and on a load balancer it exists to solve a routing problem rather than an addressing one. If a server replies directly to a client using its own default gateway, the response bypasses the load balancer, arrives with an unexpected source address, and the client discards it because it never opened that connection.

Replacing the source with an address the load balancer owns forces the return path back through the device that holds the connection state. The cost is immediate and is the trade every deployment makes: the server now sees the load balancer's address on every connection instead of the real client, which breaks source-based access control and makes logs useless for attribution unless the original address is preserved elsewhere, typically in an X-Forwarded-For header.

The scaling limit catches teams by surprise. Each translated connection consumes a source port on the shared address, so a single SNAT address supports on the order of sixty thousand simultaneous connections per destination, and busy virtual servers exhaust that. Address pools exist precisely for this, and port exhaustion presents as intermittent connection failures under load rather than as anything that names itself.

Also known as: snat, source nat

← All glossary entries