Like Barry says, Full NAT is not the same as DNAT + SNAT.
Full NAT and DNAT both deal with traffic arriving at an interface; SNAT deals with traffic leaving an interface.
Full NAT is DNAT with the Source IP/traffic also changed. It's helpful, for example, if you have two routers and you have a DNAT in the second router; you'll likely want a Full NAT in the first router with a change of the Source-IP to the Internal IP of the first router.
In most cases, a Full-NAT is used to avoid creating new static routes in other devices. Sometimes, a Full-NAT rule is the only solution. An example of that is when two sites are connected via VPN and you want to offer a public IP at one site for a server located in the other site.
An SNAT simply changes the source (IP and/or service) in a packet. Most of the times I've seen SNAT to be necessary are examples of unexpected changes. If the Astaro is in place, and a decision is made to eliminate another edge router that was handling email, you would put the public IP as an Additional Address on the External interface and SNAT SMTP traffic from it.
This is a less-preferred substitute for having a Masquerading rule and a Firewall rule.
A packet from the client comes into the Astaro via the VPN tunnel with a source address like 10.242.1.6, service HTTP and destination 87.77.67.57. With the SNAT rule, the Astaro changes the source to its External (public) IP, like 84.94.14.24 and sends the packet out the External interface to 87.77.67.57.
When the web server at 87.77.67.57 sends its response back to 84.94.14.24, the Astaro recognizes that it was in response to a connection that it is tracking, so it accepts the packet, changes the destination to 10.242.1.6 and sends it through the VPN tunnel to the client.
This is a less-preferred substitute for having a Masquerading rule and a Firewall rule.
A packet from the client comes into the Astaro via the VPN tunnel with a source address like 10.242.1.6, service HTTP and destination 87.77.67.57. With the SNAT rule, the Astaro changes the source to its External (public) IP, like 84.94.14.24 and sends the packet out the External interface to 87.77.67.57.
When the web server at 87.77.67.57 sends its response back to 84.94.14.24, the Astaro recognizes that it was in response to a connection that it is tracking, so it accepts the packet, changes the destination to 10.242.1.6 and sends it through the VPN tunnel to the client.
