Network Address Translation rewrites address fields, and often transport ports, as packets cross a translating device. It is widely used to connect privately addressed IPv4 networks through a smaller set of externally routable addresses.
Subnetting · Lesson 6
NAT
Learn how source, destination, and port translation modify IPv4 flows and connection state.
Source Translation
Source NAT replaces a packet's source address as it leaves a network. Many-to-one deployments also translate source ports so several internal flows can share one external address. This port-aware form is often called NAPT, PAT, or masquerading when the external address can change.
The translator tracks mappings so reply packets can be rewritten back to the original internal endpoint. It normally forwards the same transport flow; it does not have to open a separate proxy connection as an application proxy would.
What does source NAT change on an outbound packet?
Destination Translation
Destination NAT rewrites the destination address or port, commonly to publish an internal service through an external endpoint. A port-forward rule might map an external TCP port to a different internal address and port. Return traffic needs consistent reverse translation.
Which NAT form commonly implements an inbound port forward?
NAT and Firewall Policy
NAT is not a firewall. A stateful translator may lack a mapping for unsolicited inbound traffic, but explicit forwarding, destination translation, filtering, and application exposure determine what is reachable. Security policy should be expressed and audited with firewall rules, least-privilege services, and end-to-end controls rather than inferred from address rewriting.
Why should NAT not be treated as a security policy by itself?
Operational Consequences
NAT can exhaust address-and-port mappings, complicate peer-to-peer protocols, obscure original sources from applications, and require special handling for protocols that embed addresses. Logs must preserve translation timestamps and mapping details if flows need to be traced.
On Linux, modern policy is commonly configured with nftables and connection tracking. Inspect the actual ruleset before changing it:
$ sudo nft list ruleset
$ sudo conntrack -L
The second command requires conntrack tooling and privileges. Ruleset changes can disconnect remote access, so use console recovery, atomic configuration, validation, and rollback.
What evidence is needed to trace a shared-address flow back to an internal client?
Lesson complete
You finished NAT
You can now distinguish address translation from routing, proxying, and firewall policy.
Identify source translation on outbound flows.
Identify destination translation in published services.
Understand how port mappings allow address sharing.
Apply explicit filtering instead of treating NAT as security.
Preserve mapping evidence and recovery access during changes.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account