NAT

Network Address Translation — the IPv4 survival hack

Why NAT Exists

IPv4 has ~4.3 billion addresses. There are ~20+ billion connected devices. NAT is the hack that made this work — it lets thousands of devices share a single public IP address. Without NAT, IPv4 would have been exhausted in the late 1990s.

SNAT (Source NAT) / Masquerading

SNAT rewrites the source IP of outbound packets. This is how many private hosts share one public IP for internet access — the most common form of NAT.

How SNAT Works — Step by Step

1. Host A sends a packet:
   src=192.168.1.10:44820 → dst=93.184.216.34:443
2. NAT router rewrites source and records mapping:
   src=203.0.113.5:61234 → dst=93.184.216.34:443
   Conntrack entry: 192.168.1.10:44820 ↔ 203.0.113.5:61234
3. Web server replies to the public IP:
   src=93.184.216.34:443 → dst=203.0.113.5:61234
4. NAT router looks up conntrack, rewrites destination:
   src=93.184.216.34:443 → dst=192.168.1.10:44820

Packet Transformation

MASQUERADE vs SNAT

iptables SNAT / MASQUERADE Rules

# SNAT with a static public IP
iptables -t nat -A POSTROUTING \
  -s 192.168.1.0/24 \
  -o eth0 \
  -j SNAT --to-source 203.0.113.5

# MASQUERADE with dynamic IP (typical for home/VPN setups)
iptables -t nat -A POSTROUTING \
  -s 192.168.1.0/24 \
  -o eth0 \
  -j MASQUERADE

# Don't forget: enable IP forwarding!
sysctl -w net.ipv4.ip_forward=1

DNAT (Destination NAT) / Port Forwarding

DNAT rewrites the destination IP/port of inbound packets. This is how you expose an internal service on a public IP — the reverse of SNAT.

# Port forward: public :80 → internal 192.168.1.10:80
iptables -t nat -A PREROUTING \
  -p tcp --dport 80 \
  -j DNAT --to-destination 192.168.1.10:80

# You also need to allow the forwarded traffic through the filter table
iptables -A FORWARD \
  -p tcp -d 192.168.1.10 --dport 80 \
  -m conntrack --ctstate NEW,ESTABLISHED \
  -j ACCEPT

# Port remapping: public :8443 → internal :443 (different ports)
iptables -t nat -A PREROUTING \
  -p tcp --dport 8443 \
  -j DNAT --to-destination 192.168.1.10:443

Conntrack Entries for NAT

Every NAT translation creates a conntrack entry that stores the bidirectional mapping. This is how the kernel knows to reverse the translation for return traffic.

    $ conntrack -L -n

    tcp  6 117 ESTABLISHED src=192.168.1.10 dst=93.184.216.34 sport=44820 dport=443

                           src=93.184.216.34 dst=203.0.113.5 sport=443 dport=61234 [ASSURED] mark=0


    # ↑ Two tuples per entry:

    # Tuple 1 (original): what the LAN host sent

    # Tuple 2 (reply):    what the reply should look like BEFORE un-NATing
  

CGNAT (Carrier-Grade NAT)

CGNAT is NAT applied by your ISP, putting your entire home network behind yet another layer of NAT. Your home router does NAT (private → home public IP), then the ISP does NAT again (home public IP → shared ISP IP).

Double NAT Topology

NAT Breaks End-to-End Connectivity

This is the fundamental architectural problem that NAT introduces, and understanding it is essential for grasping why VPNs, overlay networks, and NAT traversal techniques exist.

The Inbound Connection Problem

1. Outbound: Works

   192.168.1.10 → NAT → Internet
   NAT creates conntrack entry
   Return traffic follows the mapping

2. Inbound: Blocked

   Internet → NAT → ???
   No conntrack entry exists
   NAT doesn't know which device to forward to

NAT Traversal Techniques

NAT Operations Summary