NAT: changing license plates at the toll booth
Imagine a highway where one gate manager has decided that every car leaving the neighbourhood must use the same licence plates.
What could possibly go wrong? 🤣
The Quiet Network Estate
There are four houses on a small estate. A computer with plate 192.168.1.10 is parked outside the first, a laptop 192.168.1.11 outside the second, a phone 192.168.1.12 outside the third, and a smart fridge 192.168.1.13 outside the fourth. The fridge has just announced that the milk has run out.
The owner tells it the milk is on the second shelf. The fridge replies that it does not have permission to search the second shelf. The matter is referred to the estate management.
All the vehicles have their own numbers and travel freely around the local streets. But one day the computer decides to join the great Internet highway.
It pulls up at the gate.
— Good morning! I'd like to visit a video server.
— Vehicle documents, please.
— Here you are.
— Plates 192.168.1.10?
— Correct.
— You can't leave with those.
— WHY NOT?!
— Those are neighbourhood plates. We don't accept them on the highway.
— So what do I do?!
— We'll replace them.
— With what?
— Ours.
The manager takes out a screwdriver, removes the plates and bolts on new ones:
193.24.14.111
— Done. Have a safe journey!
— But that isn't my number!
— It is now.
— And how will I get home?!
— I'll recognise you.
— HOW?!
— Relax. I write everything in my notebook.
Meet NAT — Network Address Translation.
The estate plate is a private IP address. The highway plate is public. Our manager has just translated one into the other.
One number for everybody
Five minutes later, the laptop arrives at the gate.
— Hello, I'm off to check my email.
— Certainly. New plates for you.
— What number?
— 193.24.14.111.
— Hang on! The previous car had those!
— Correct.
— YOU HAVE ANOTHER IDENTICAL SET?!
— Just the one.
— THEN HOW CAN WE BOTH DRIVE UNDER THAT NUMBER?!
— Normally.
— BUT THAT'S ILLEGAL!
— On ordinary roads, perhaps. Here the management writes the rules.
Next comes the phone.
— One highway trip, please.
— 193.24.14.111. NEXT!
Then the fridge.
— I'm here about the milk.
— 193.24.14.111.
— But I have an important complaint!
— Please don't block the gate.
Four different devices now travel onto the Internet using one public IP address.
This is typical home-network masquerading — a form of source NAT (SNAT).
Of course, there's a problem. How do you tell four cars apart when they all have the same number?
The notebook that holds the highway together
The computer reaches the server, requests a video and waits for the response. The server sends the data back to 193.24.14.111.
The reply arrives at the estate gate.
— Hello! Delivery for vehicle 193.24.14.111.
— Splendid.
— Who gets it?
— One moment...
The manager opens his notebook.
— There was a computer, a laptop, a phone and a fridge.
— Which one gets the delivery?
— Let me check.
— YOU DON'T KNOW?!
— I DO! I JUST NEED TO FIND THE RIGHT ENTRY!
— AND WHAT'S IN THAT NOTEBOOK?!
— Port numbers!
— WHAT KIND OF PORTS?!
— NOT SEAPORTS! PLEASE CALM DOWN!
Now it gets interesting.
An IP address alone isn't enough to distinguish all these simultaneous conversations. Port numbers help us do that. Imagine every car has a case number in addition to its licence plate.
The computer leaves as 192.168.1.10:51001. The manager sends it out as 193.24.14.111:40001.
The laptop leaves as 192.168.1.11:51001 and goes out as 193.24.14.111:40002.
The gate manager's notebook — a simplified example:
| Inside the estate | On the highway |
|---|---|
192.168.1.10:51001 | 193.24.14.111:40001 |
192.168.1.11:51001 | 193.24.14.111:40002 |
192.168.1.12:52000 | 193.24.14.111:40003 |
192.168.1.13:53000 | 193.24.14.111:40004 |
These addresses and ports are examples. Real connection tracking also records other information, including the protocol and connection parameters.
A reply arriving at port 40001 goes to the computer. At 40002, it goes to the laptop. And at 40004...
— DELIVERY FOR THE FRIDGE!
— ABOUT THE MILK?!
— I DON'T KNOW! I DON'T READ OTHER PEOPLE'S MAIL!
— THEN HOW DO YOU KNOW IT'S FOR THE FRIDGE?!
— BECAUSE I HAVE A NOTEBOOK!
Sharing an address using ports is called PAT (Port Address Translation), or more formally NAPT.
What if the notebook goes missing?
One day the gate manager decides to tidy his desk.
— What's this old notebook?
— Connection records.
— Do we need it?
— No idea. It's been here since morning.
— Throw it away, then.
Five minutes later...
— BOSS! A REPLY JUST ARRIVED FOR PORT 40001!
— Deliver it!
— TO WHOM?!
— What do you mean?!
— THE NOTEBOOK'S GONE!
— CHECK THE LICENCE PLATES!
— THEY'RE ALL THE SAME!!!
That's why a device performing stateful NAT needs to remember its active translations.
In reality those records live in the device's memory, in state or translation tables, not in a leather-bound notebook stamped “TOP SECRET”.
If that state disappears, replies belonging to existing connections may no longer reach the right recipients.
— Can we rebuild the notebook?
— From what?
— From memory!
— THIS IS A ROUTER, SIR, NOT A PSYCHIC!
Now try inviting someone home
Until now, the residents have always driven out first. The manager recorded their trips and knew where to send the replies.
Then the computer decides to run its own server.
— I'm hosting meetings! Everybody's welcome!
It sends an invitation. A friend drives up to the estate gate.
— Hello! I'm here to visit the server.
— Which server?
— At 193.24.14.111.
— That's our estate.
— Exactly.
— Which house?
— Don't know. That's the address I got.
— Case number?
— Port 8080.
The manager checks his notebook.
— Nothing here.
— WHAT DO YOU MEAN NOTHING?!
— Nobody told me you were coming.
— BUT I HAVE AN INVITATION!
— AND I DON'T HAVE AN ENTRY!
— THEN CALL THE OWNER!
— WHICH OWNER?!
This is a familiar obstacle when someone outside tries to start a connection to a device behind NAT.
There is no rule telling the gate where to send an unexpected incoming connection.
Special passes — port forwarding
The next day the computer visits the administration office.
— I'd like to receive visitors.
— Very good. Fill in this form.
— What form?
— Port forwarding.
— IN PLAIN ENGLISH?!
— Anyone arriving at our public address through gate 8080 must be sent to your house.
— That's all?
— That's all.
— THEN WHY COULDN'T I DO IT YESTERDAY?!
— BECAUSE YESTERDAY THERE WAS NO FORM!
The manager writes:
193.24.14.111:8080 → 192.168.1.10:80
Now incoming traffic to that address and port can be directed to the computer.
This is DNAT (Destination NAT). In this situation it's commonly called port forwarding.
— Can I forward every gate?
— There are technical ways to do that.
— Excellent! I'll take them all!
— Do you know everybody you'll be letting onto the estate?
— ...
— Exactly. Perhaps we'll start with one gate.
NAT is not a substitute for a properly configured firewall. Exposing services to the Internet still requires sensible access rules.
An estate behind another estate — CGNAT
Everything was running perfectly. Until one day the highway operator announced a reorganisation.
— Starting tomorrow, your estate will no longer have its own direct exit to the Internet.
— WHAT?!
— All estates must pass through our shared gate.
— But we already have a gate!
— Wonderful. Now you'll have two.
The journey now looks like this:
Computer 192.168.1.10 → home NAT gate 100.64.12.34 → operator CGNAT gate 193.24.14.72 → Internet
— Hello, I'm here to visit a computer at the Quiet Network Estate.
— Take that to the first gate.
— They told me to go to the operator.
— And the operator?
— Says I can't pass without a permit.
— Then get a permit!
— BUT WHO ISSUES IT?!
— The operator.
— THE OPERATOR SAYS THEY DON'T ISSUE THEM!!!
Welcome to CGNAT (Carrier-Grade NAT) — address translation performed by an Internet provider for many customers.
CGNAT conserves public IPv4 addresses but can make direct incoming connections difficult.
If the operator doesn't offer the necessary forwarding, opening a port on your home router isn't enough.
— So I have my own router, my own ports, my own notebook, AND I STILL CAN'T INVITE GUESTS?!
— Correct.
— THEN WHAT'S MY NOTEBOOK FOR?!
— Outbound trips. Those work beautifully.
— AND RETURN TRIPS?!
— Replies to recorded outbound trips work too.
— AND VISITORS?!
— Please take that up with upper management.
UPnP — when the car gets its own pass
A games console also lives on our estate. The console hates paperwork. The console likes games.
One day it drives up to the gate.
— Please open an entrance for my friends.
— Application form?
— Don't have one.
— Administrator's signature?
— Don't have one.
— THEN ON WHAT AUTHORITY?!
— On the grounds that I really, really want to.
— ...
— I have an automatic request system.
— Ah, well, that's different. Go ahead.
And the manager adds the rule himself.
This is roughly how UPnP IGD works: applications and devices on the local network may automatically ask the router to create a port mapping.
Convenient? Very.
But should every device on the estate be allowed to open highway gates for itself?
— Hello, I'm a smart toaster.
— Yes?
— I'd like to open eighteen ports.
— WHAT FOR?!
— Updates.
— EIGHTEEN?!
— Manufacturer's recommendation.
— AND WHO'S THE MANUFACTURER?!
— Can't disclose. Trade secret.
That's why automatic port mapping deserves some thought, especially when your network is full of devices you don't necessarily trust.
Why not give everyone their own plates?
One day a new estate manager arrives with a gigantic box of licence plates.
— Enough nonsense! Every car gets its own globally unique number!
— Really?!
— Yes.
— And the notebook?
— For some purposes, we won't need it.
— And swapping the plates on the way out?
— That won't be necessary either.
— WHERE DID YOU GET SO MANY NUMBERS?!
— IPv6.
Suddenly each car can have its own global address without the entire estate having to share a single IPv4 number.
IPv6 does not need NAT to conserve addresses the way IPv4 often does.
But that doesn't mean anyone can drive straight into any house.
— So everybody can visit me now?!
— No.
— WHY NOT?!
— Because we still have estate security.
— WHAT SECURITY?!
— A firewall.
— BUT I HAVE MY OWN PLATES!
— Licence plates are not house keys, sir.
And that's the crucial distinction: addressing and address translation are one thing; access control is another.
You don't have to swap everybody's plates to decide who may enter your property.
What really happens at the gate?
Real NAT doesn't unscrew licence plates. It changes certain address fields in IP packets and, in common port-based forms, TCP or UDP port numbers too.
Depending on the translation rule, the source address, destination address or both may be modified.
Key terms from our trip:
| Term | On our highway |
|---|---|
| NAT | Changing licence plates |
| SNAT | Changing plates on the way out |
| Masquerade | SNAT using the outgoing interface's address |
| PAT / NAPT | Extra case numbers to distinguish the cars |
| DNAT | Choosing the house for an arriving visitor |
| Port forwarding | A permanent pass for a particular gate |
| CGNAT | Another gate, this time run by the provider |
| UPnP IGD | Automatically requesting gate passes |
| IPv6 | Enough numbers that we don't need to share them |
NAT's biggest advantage in the IPv4 world? Many devices can access the Internet while sharing one public address.
Its greatest inconvenience? When an outsider wants to initiate a conversation with a particular device, somebody must arrange a way in.
And remember: NAT is address translation, not magical protection against every Internet threat.
To explore more of our Packet Highway, take a look at IP addresses, DHCP, TCP and UDP, routing.
Meanwhile, back at estate management...
— BOSS! WE'VE GOT A PROBLEM!
— AGAIN?!
— The fridge wants to go on the highway.
— Let it go.
— But it demands its own public address!
— WHY WOULD A FRIDGE NEED A PUBLIC ADDRESS?!
— Says it refuses to share licence plates with the toaster.
— AND THE TOASTER?!
— Already left.
— WHERE TO?!
— WE DON'T KNOW!
— THE NOTEBOOK?!
— ...
— WHERE'S THE NOTEBOOK?!
— The fridge says it's on the second shelf.
— THEN TELL IT TO GET THE NOTEBOOK!!!
— IT DOESN'T HAVE PERMISSION. 🤣
Next time we can visit TCP and UDP, our two delivery companies. One insists on proof of delivery, while the other leaves the parcel on the doorstep and drives away before anyone can ask for the order number.
The highway manager declined to comment. He's still looking for the notebook.