Short Notes on NAT (Network Address Translation)

Definition. NAT is a method of remapping IP addresses as packets pass through a router/firewall: the source address (and port) of an outgoing packet is replaced by an address of the NAT device, and returning packets are translated back using a translation table. It operates at Layer 3 of the network layer and is specified in RFC 1631 (original NAT) and RFC 3022 (Traditional NAT).

Why NAT is needed

1. Address conservation. The private addresses of RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — are not routable on the public Internet. NAT lets hundreds of hosts in a home or office share one public IPv4 address.
2. Security / abstraction — internal addresses and topology are hidden from outsiders, and the internal numbering need not change when the ISP changes the public address.

Types

Type	Mapping	Typical use
Static NAT	one private $\leftrightarrow$ one public, permanent	servers that must be reached from outside
Dynamic NAT	one private $\leftrightarrow$ one public, taken from a pool for the session and released after a timeout	small pools where each active host needs a public IP
PAT / NAT overload	many private $\rightarrow$ 1 public, distinguished by unique port numbers	home routers and most offices — the default today
Double NAT / CGNAT	carrier-grade NAT using the shared space 100.64.0.0/10 (RFC 6598)	ISPs short of public IPv4 addresses

How PAT works

The NAT device keeps a table such as

(192.168.1.10, 5001)  <->  (203.0.113.5, 40001)   TCP
(192.168.1.11, 5002)  <->  (203.0.113.5, 40002)   TCP
(192.168.1.10, 5003)  <->  (203.0.113.5, 40003)   UDP

The unique source port lets the NAT box demultiplex the returning segments to the correct internal host, so one public address serves many private ones. Entries are created on outbound traffic and deleted after a timeout.

Limitations

• It breaks the end-to-end principle: an internal host cannot be addressed from outside, so servers need static mappings / port forwarding.
• Protocols that carry addresses in the payload (FTP PORT, SIP, IPsec AH) need an ALG (application-layer gateway) to rewrite them; transport-mode IPsec ESP fails under NAT, which is why NAT-Traversal (UDP encapsulation on port 4500) exists.
• It complicates peer-to-peer applications, end-to-end diagnostics and tracing, since the public port identifies only the NAT box, not the internal host.
• The pool of public addresses can be exhausted by concurrent sessions — PAT is used precisely to avoid this.