Network Address Translation (NAT)

Network Address Translation (NAT) is a networking methodology designed to map one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a routing device.

NAT was created as a temporary mitigation strategy to combat IPv4 address exhaustion, but it has become an fundamental pillar of modern network architecture and firewall security.

1. The Core Problem: Private vs. Public IPs

The IPv4 address space is limited to roughly 4.3 billion addresses (2³²). To prevent rapid depletion, RFC 1918 reserved specific subnets for internal use (private networks). These addresses cannot be routed over the public internet:

• 10.0.0.0 to 10.255.255.255 (Class A)
• 172.16.0.0 to 172.31.255.255 (Class B)
• 192.168.0.0 to 192.168.255.255 (Class C)

Because private IPs are non-routable, a local router must translate private IPs to public IPs before sending packets out to the public internet, and vice versa.

2. How NAT Works: The Translation Table

When a client device behind a NAT router makes an outbound request, the router intercepts the packet, changes the source address, and records this transaction in its internal translation database.

[ Private Network ]                                     [ Public Internet ]
Client: 192.168.1.50:8000                               Server: 93.184.216.34:443
        |
        v (Packet: Source=192.168.1.50:8000, Dest=93.184.216.34:443)
  [ NAT Router ] (Public IP: 203.0.113.10)
        |  *Router translates Source to 203.0.113.10:15000*
        |  *Stores map in NAT Table*
        v
        v (Packet: Source=203.0.113.10:15000, Dest=93.184.216.34:443)
[ Internet Destination ]

The NAT Router's Translation Table

When the remote server replies, it sends packets back to 203.0.113.10:15000. The router checks its table, finds the entry, translates the destination back to 192.168.1.50:8000, and forwards the packet to the private device.

3. Types of NAT

Different network topologies and constraints require different NAT implementation strategies.

1. Static NAT (One-to-One)

Maps a single private IP address to a single public IP address.

• Use Case: Hosting a local web server that needs to be directly accessible from the outside.
• Limitation: Does not save public IP addresses (1:1 ratio).

2. Dynamic NAT

Maps private IP addresses to public IP addresses dynamically chosen from a pre-allocated pool of public IPs.

• Use Case: Large networks where not all hosts need internet access concurrently.
• Limitation: If the public IP pool is exhausted, new outbound connections are blocked.

3. Port Address Translation (PAT / NAT Overload)

The most common NAT type. Maps thousands of private IP addresses to a single public IP address by tracking connections through ephemeral source ports (e.g., mapping outbound connections to different ports on the public IP, like 203.0.113.10:15000, :15001, etc.).

• Use Case: Home Wi-Fi routers, enterprise office networks.

4. Carrier-Grade NAT (CGNAT)

Used by ISPs (Internet Service Providers) to conserve their public IPv4 addresses. Instead of allocating a unique public IP to each household/office router, the ISP pools multiple customers behind a single massive PAT system.

• Limitation: Disrupts inbound port-forwarding, breaks Geo-IP targeting, and causes issues with online multiplayer gaming and peer-to-peer protocols.

4. NAT Traversal & Hole Punching

Because NAT expects all traffic to initiate from the private network, it naturally blocks any unsolicited inbound packets. This makes peer-to-peer (P2P) systems (like VoIP, WebRTC video calling, and online multiplayer gaming) impossible without traversal mechanisms.

To solve this, developers use Hole Punching protocols:

                  +---------------------------+
                  |  [ STUN/TURN Server ]     |
                  +-------------+-------------+
                                |
             +------------------+------------------+
             |                                     |
             v                                     v
       [ NAT Router A ]                      [ NAT Router B ]
     (Client A: 192.168.1.5)               (Client B: 192.168.2.9)

1. STUN (Session Traversal Utilities for NAT): A protocol allowing a client behind a NAT to discover its public mapping (IP address, NAT mapping port, and type of NAT). Once both clients discover their public endpoints via STUN, they can send traffic directly to each other's public endpoints, "punching" a hole in their respective NAT firewalls.
2. TURN (Traversal Using Relays around NAT): If one of the clients is behind a Symmetric NAT (which changes the port mapping dynamically depending on the destination IP), direct hole punching fails. In this case, TURN serves as a fallback. Both clients send their data to a public TURN relay server, which forwards the traffic.
   • Note: Because TURN relays 100% of the media traffic, it is resource-intensive and expensive.
3. ICE (Interactive Connectivity Establishment): A framework that coordinates STUN and TURN. ICE collects all candidate connections (local IP, STUN mapped IP, and TURN relay IP) and negotiates the most optimal connection path.

5. Architectural Trade-offs of NAT