Which statement is true about NAT chains in RouterOS firewall configuration?

• A. NAT uses src-nat and dst-nat chains
• B. NAT uses Forward and Input chains
• C. NAT uses Masquerade and Jump
• D. NAT has no defined chains

Answer: (A)

In RouterOS, NAT operates in its own NAT table with two chains: a source NAT chain and a destination NAT chain. The source NAT chain (srcnat) handles translating the source address of outgoing traffic, which is how masquerading works when devices access the Internet. The destination NAT chain (dstnat) handles translating the destination address for incoming traffic, enabling port forwarding to internal hosts.

The other ideas mix NAT with the firewall’s filter chains (Forward and Input belong to the filter table, not NAT), or treat actions like masquerade or mechanisms like Jump as the chain itself. Masquerade is an action used within the srcnat chain, not a separate NAT chain, and Jump is not a NAT chain. There are defined NAT chains, so the statement with no defined chains isn’t correct.