Network address translation lets many machines with private addresses share one address when they talk to another network, by rewriting the source address and port on the way out and reversing it on the way back. A settlement that is only connected to its own neighbours does not need it, because the neighbours’ addresses are routable once the plan has no overlaps. Use NAT only at the one router where a private network meets a network that cannot be renumbered, and expect it to break protocols that carry addresses inside their data.
Part of Networking
Translating private addresses to a shared outside address: how the translation table works, when a settlement needs it and what it costs.
Translation Is A Workaround For Scarce Or Clashing Addresses
Network Fundamentals describes NAT as letting many devices share one public address by rewriting addresses in packet headers, noting that it extended the life of IPv4 but adds complexity and breaks some protocols. The carrier Internet Infrastructure puts NAT at the router that is the gateway to any external network.
The reason to use it was the shortage of public addresses: a household or an office held one public address and many private machines. A settlement has neither the shortage nor, for its own purposes, any outside network. NAT matters in two cases only. One is a single link out to a network that expects one address from you. The other is joining a neighbour whose private block overlaps yours and cannot be changed (Private Ranges); translating at the boundary hides the clash, though renumbering is the better cure.
How The Table Works
When a private machine sends to an outside machine, the NAT router replaces the source address with its own outside address and the source port with a port it chooses, and records the pairing in a table. A reply arrives addressed to the router’s address and that chosen port, and the router looks it up and restores the private address and port. Ports are 16-bit numbers (Network Addressing), and that gives the router its supply of distinct translations: Network Addressing puts the ephemeral range at 49152 to 65535.
Traffic that starts outside has no table entry, so it is dropped unless the router is told to forward a given port to a given machine (a port forward). That is why a service behind NAT cannot be reached from outside by default, and why this behaves like a firewall without being one (Firewalls).
What You Need
- A router with two interfaces, one on the private side and one on the outside (Routing Basics: any Linux computer with IP forwarding enabled)
- A reason — an outside link that expects one address, or an unresolvable overlap
Method: Add NAT At The Boundary Router Only
Step 1: Confirm routing works first With forwarding on and routes correct, the private machines should reach the router’s outside interface.
Step 2: Enable translation on the outside interface On Linux this is done in the packet filter (masquerading on the outside interface); the exact commands depend on the tool (Firewalls).
Step 3: Add port forwards for any service that must be reachable from outside Each one names an outside port and the private machine that receives it.
Step 4: Test from a private machine and read the table Open a connection to the outside, then list the translation table to see the entry.
Worked Example: Three Machines, One Outside Address
Private machines 10.1.0.21, 10.1.0.22 and 10.1.0.23 each open a connection to the same outside server at 198.51.100.7, port 80. The router’s outside address is 203.0.113.5 (both outside addresses are invented for the example, from ranges set aside for documentation; that is general knowledge).
| Private source | Router rewrites to | Destination |
|---|---|---|
| 10.1.0.21:51000 | 203.0.113.5:40001 | 198.51.100.7:80 |
| 10.1.0.22:51000 | 203.0.113.5:40002 | 198.51.100.7:80 |
| 10.1.0.23:52311 | 203.0.113.5:40003 | 198.51.100.7:80 |
The first two machines happened to choose the same source port, 51000. The router tells them apart by giving each a different outside port. The server sees three connections from one address and three different ports. A reply to 203.0.113.5:40002 is restored to 10.1.0.22:51000.
If the router can use the whole ephemeral range, 65535 - 49152 + 1 = 16,384 simultaneous translations to one destination are available before ports run out.
Common Mistakes
- Using NAT everywhere out of habit — inside a settlement, every machine should keep its own address so logs, firewall rules and file shares can name it
- Expecting a service behind NAT to be reachable — it needs a port forward
- Forgetting that some protocols carry addresses inside the data — they break when the address is rewritten; this is a general feature of NAT, noted in Network Fundamentals
- Treating NAT as security — it is not; use Firewalls
What’s Next
- Learn next: Routing Protocols — how packets get to the boundary router in the first place
- Combine with: Firewalls — the packet filter that usually performs the translation