When is NAT Masquerading required?

Question

I'm learning about NAT Masquerading and I'm a bit confused about when you would want to Masquerade. I've seen examples of using an interface for a VPN tunnel and how something like that on a router would require NAT Masquerading.

Thanks!

Answer 1

NAT is only required if you have overlapping addressing, or you are trying to connect a privately addressed network to the public Internet (which is really a form of overlapping addressing because other sites may use the same Private addressing).

The Private IPv4 address ranges were selected to allow anyone to use those addresses on their own networks, and the ISPs (by agreement) will not route privately addressed packets on the Public Internet. Some ISPs may use Private or Shared addressing internally (see CGN), and that can cause a double-NAT that can be a big problem for those trying to provide services to the public Internet.

When companies that use Private addressing inside the company merge, they will often need to use NAT because the merged company will have overlapping addressing. The use of NAT for the overlapping addressing should be a temporary situation until the addressing can be fixed. This is often a major disruption (among the many disruptions) of two companies merging.

---

I often see questions on other SE sites where people are trying to use NAT as a substitute for routing. This is a poor practice that can lead to problems, and it is often much more complicated that simple routing. It may work for very wimple cases, but as things grow or get more complicated, e.g. more than one server of the same type behind the NAT and trying to use the same TCP port, it will often create big problems.

---

A business using a VPN is normally connecting two sites of the business, or connecting an extranet to another business. The VPN tunnel looks like a cable directly connecting the two sites. If the sites do not have overlapping addressing, then NAT should not be used, only simple routing. The VPN tunnel interface in the router is just another router interface, and the router can route packets through the tunnel as if it were a directly connected interface inside the company network.