Network Address Translation (NAT)

A home or office network typically has many hosts but one public IPv4 address. Inside, hosts use private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), which are not routed on the public Internet and may be reused by every organisation. A NAT router at the border rewrites addresses as packets cross it: outgoing packets get the public address as their source, and replies addressed to the public address are rewritten back to the right private host.

With one public address, the router must tell apart replies meant for different inside hosts. It does this by also rewriting the transport port, so each inside (address, port) pair is mapped to a distinct public port. This is NAPT (network address and port translation), the form almost all NAT boxes use. NAT saves public addresses and hides the inside network, but it breaks the end-to-end model: an outside host cannot start a connection to an inside host unless the router has been configured to forward it.

Each NAPT entry binds an inside endpoint to an outside endpoint:

Rewriting addresses and ports requires these checksum updates:

A NAT box need not recompute them over the whole packet: RFC 1624 gives an incremental update. If a 16-bit word changes from $m$ to $m'$, the new checksum is

in one's complement arithmetic, applied once per changed word.

Payload addresses. Protocols that write IP addresses or ports inside their data (FTP's PORT command is the classic one) need an application-level gateway in the NAT box that edits the payload too, including any change in its length.

Inside network 192.168.1.0/24; NAT router with public address 203.0.113.7; web server 198.51.100.20:80. Both inside hosts happen to choose source port 50000.

The server sees two connections from 203.0.113.7, told apart only by the ports 6001 and 6002. The port numbers 6001 and 6002 are an arbitrary choice of this NAT box; any free ports would do.

A public address with 16-bit ports can carry at most $2^{16} = 65{,}536$ distinct port mappings per transport protocol at once (fewer in practice, since some ports are reserved or excluded). With $N$ inside hosts each holding $c$ concurrent sessions to arbitrary destinations, a single public address needs $N c \le$ the available port count when each mapping uses a distinct public port. For example, 1000 hosts with 50 sessions each need 50,000 mappings: one address is enough by this count; 2000 hosts would need two.

An outbound UDP datagram from 192.168.1.10:5353 leaves as 203.0.113.7:6100. Changed by the NAT box: IP source address, UDP source port, IP header checksum, UDP checksum if nonzero (it covers the source address through the pseudo-header and the port directly; zero stays zero), and TTL (decremented as at any router, which also changes the IP checksum). Unchanged: destination address and port, identification, protocol, data.

A UDP checksum is 0x1C2B. NAT changes the source port word from 0x14E9 (5353) to 0x17D4 (6100). With one's complement addition (carry wrapped round):

so the new checksum is $\sim\texttt{0xE6BF} = \texttt{0x1940}$. The same update is applied for each changed address word.

A server outside sends a TCP SYN to 203.0.113.7:22. Without a port-forwarding entry for port 22, the NAT box has no mapping and drops it: inside hosts are reachable only through sessions they started, or through configured forwarding.

A host in 10.0.0.0/8 behind a NAT whose outside address is 192.168.1.50, itself behind the home NAT with public address 203.0.113.7. Outbound packets are translated twice; the server sees 203.0.113.7 and the second NAT's port. Replies are translated back through both tables in reverse order.

Common misconceptions.