DNAT Explained: Publishing an Internal Service Through One Public Address and Port

Hit a public address:port and get nothing, add one DNAT rule, and the same request lands on a hidden internal server — then read the conntrack table to see how the reply gets un-NATed.

Raccontata dadev.to