What is the difference between srcnat and dstnat in MikroTik NAT configuration?

What is the difference between srcnat and dstnat in MikroTik NAT configuration?

• A. srcnat translates the source address for outbound traffic (often masquerade); dstnat translates the destination address/port for inbound traffic (port forwarding)
• B. srcnat translates the destination address for inbound traffic; dstnat translates the source address for outbound traffic
• C. Both translate the same
• D. NAT is not used for VPN

Answer: (A)

NAT in MikroTik is about where the translation happens and what it changes. Source NAT rewrites the sender’s address on outbound traffic, so devices on your private network can reach the Internet using a single public IP. Masquerade is a common form of this, especially when the public IP can change, because it automatically uses the router’s current public IP for all outgoing connections. Destination NAT, on the other hand, rewrites the destination address (and often the port) for inbound traffic. This is how port forwarding works: a request from the Internet to your public IP on a specific port is redirected to a chosen internal host and port, such as directing port 80 traffic to 192.168.1.10:80. So, the first type handles outbound translation of the source, while the second handles inbound translation of the destination. This distinction is why the described behavior is the correct one.

NAT in MikroTik is about where the translation happens and what it changes. Source NAT rewrites the sender’s address on outbound traffic, so devices on your private network can reach the Internet using a single public IP. Masquerade is a common form of this, especially when the public IP can change, because it automatically uses the router’s current public IP for all outgoing connections.

Destination NAT, on the other hand, rewrites the destination address (and often the port) for inbound traffic. This is how port forwarding works: a request from the Internet to your public IP on a specific port is redirected to a chosen internal host and port, such as directing port 80 traffic to 192.168.1.10:80.

So, the first type handles outbound translation of the source, while the second handles inbound translation of the destination. This distinction is why the described behavior is the correct one.