Skip to content
BytePath
BytePath v0.0.35

NAT Fundamentals

Networking Learning Path · Step 9Available

Network Address Translation changes address and sometimes port information at a network boundary. The key is to treat NAT, routing, and firewall as separate decisions.

Difficulty
Intermediate
Duration
55 minutes
Practice
Translation table
Quiz
3 questions

Before you start

Who is this for?

For learners with IPv4 and routing knowledge who want to understand internet access and published services.

Prerequisites

  • Private and public IPv4 addresses
  • routing, ports, and return paths

What you'll be able to do

  • Distinguish source NAT, destination NAT, and PAT
  • read a translation table
  • plan port forwarding and firewall rules separately
  • recognize double NAT and return-path errors

Practical outcome

You can document the forward and return path of a translated HTTPS connection with addresses and ports.

1. Why NAT is used

Section titled “1. Why NAT is used”

Private IPv4 ranges such as 192.168.0.0/16 are not globally routed on the public internet. A gateway can therefore exchange a private source address for a public address at the boundary. Answers are assigned back to the internal flow using a state table.

NAT was also used for network renumbering, overlapping address spaces, and publishing individual services. Its best-known role, however, is sharing scarce public IPv4 addresses.

2. Source NAT and PAT

Section titled “2. Source NAT and PAT”

Client 192.168.10.25 opens an HTTPS connection to 198.51.100.20:443 and uses a local dynamic source port such as 51514:

Before NAT:  192.168.10.25:51514 → 198.51.100.20:443 TCP
After NAT: 203.0.113.5:62001  → 198.51.100.20:443 TCP

The gateway stores this mapping. The answer to 203.0.113.5:62001 can be translated back to 192.168.10.25:51514.

With Source NAT (SNAT) the source address changes. Port Address Translation (PAT), also called NAT Overload, additionally translates ports. This allows many internal connections to use the same public IPv4 address. Protocol, internal and external addresses, ports, and timeouts together form the state; “one port permanently belongs to one PC” would be wrong.

3. Static and dynamic translations

Section titled “3. Static and dynamic translations”
  • Static NAT: fixed mapping between an internal and an external address.
  • Dynamic NAT: mapping from a pool of available external addresses.
  • PAT: many internal flows share one or a few external addresses through port mappings.
  • Destination NAT (DNAT): changes the destination, typically for incoming port forwarding.

The exact terms differ by platform. What matters is which field is changed in which direction and how return traffic is mapped.

4. Publishing incoming services

Section titled “4. Publishing incoming services”

A web server 192.168.30.10:443 should be reachable via 203.0.113.5:443. This typically requires:

  1. a DNAT/port forwarding rule from the external destination to the internal server;
  2. a firewall rule that allows exactly the required traffic;
  3. a route and a correct return path from the server;
  4. a DNS record if users should use a name;
  5. a valid TLS certificate and a web service actually listening.

A DNS record alone does not open a port. A NAT rule alone is also not an explicit permit. Many platforms combine the configuration in a single interface, but internally these remain separate tasks.

5. NAT and IPv6

Section titled “5. NAT and IPv6”

IPv6 was designed with a much larger address space. Globally unique IPv6 addresses normally do not need address translation, but a stateful firewall remains important. “No NAT” does not mean “unfiltered”. IPv6 Privacy Extensions change outgoing interface identifiers and are also not a NAT function.

NAT64 can allow IPv6-only clients to access IPv4 services and often works with DNS64. This is a special transition mechanism, not the same as classic IPv4 PAT.

6. Typical failure patterns

Section titled “6. Typical failure patterns”

Double NAT occurs when, for example, a home router and the provider device both translate. Outgoing traffic can work while incoming port forwarding has to be configured across two layers. Carrier-Grade NAT frequently uses 100.64.0.0/10; customers do not then necessarily have an exclusively reachable public IPv4 address.

Asymmetric return path can confuse stateful NAT and firewalls when answers pass through a different device that does not know the mapping. Overlapping private networks create additional ambiguity with VPNs or enterprise mergers.

For diagnostics, document the flow before and after each boundary: source, destination, ports, protocol, interface, and direction. First check routing and listeners, then the translation table and firewall logs.

Common mistakes

Section titled “Common mistakes”
  • Describing NAT as a security mechanism or encryption.
  • Not documenting source and destination translations by direction.
  • Forgetting a return route or firewall rule with a port forwarding.
  • Confusing a public provider address with a directly assigned exclusive address.
  • Blocking IPv6 instead of deliberately addressing and filtering it.

Knowledge check

Section titled “Knowledge check”

Multiple Choice

NAT knowledge check

0 / 3

What you should now be able to do

Section titled “What you should now be able to do”
  • distinguish SNAT, DNAT, static NAT, and PAT;
  • note a translated flow in both directions;
  • explain why NAT is neither a firewall nor a replacement for encryption;
  • recognize double NAT, CGNAT, and asymmetric return paths as sources of errors.