How does packet traversal works over a public network with NAT overloading

Question

Let's say I have a private network connected to the internet with default gateway 192.168.1.1 on Router1. Now a host(Host#1, 192.168.1.10) on this network wants to send a packet over the public internet to a host(Host#2,192.168.2.10) on another private network 192.168.2.0/24 with RouterB as its default gateway. The packets from 192.168.1.0/24 network gets NATed to, say, 100.100.100.100, and for network 192.168.2.0/24 it is 101.101.101.101.

Here is what I feel how the packet will flow

1. Host#1 creates a packet with source and destination IP as 192.168.1.10 and 192.168.2.10. (I'm not sure about this. Will the destination IP be the public or private IP of Host#2?).
2. Packet reaches Router1 and gets NATed to the public IP addresses 100.100.100.100 and 101.101.101.101.
3. Packet reaches Router2.
4. Now Router2 sees a packet coming from 100.100.100.100 directed to 101.101.101.101. How does it know which host it has to route the packet to.

I'll also add that I'm talking about PAT here specifically.

Answer 1

For public Internet traversal, NAT is not a good option.

When exiting Router#1 you'd first have to SNAT the source IP 192.168.1.10 to 100.100.100.100 (with or without NATing the source TCP/UDP port as well). On arrival on Router#2 you'd have to DNAT the destination IP 101.101.101.101 to 192.168.2.10.

If Host#1 used Host#2'2 private IP as destination instead, Router#1 would also have to DNAT 192.168.2.10 to 101.101.101.101 and Router#2 would change that back.

How does it know which host it has to route the packet to?

Exactly. For both hosts to communicate transparently, you'd need static NAT with a 1:1 mapping of public to private IPs (in contrast to just port forwarding for a single service). You cannot use the public IPs for anything else (unless you create specific mappings by corresponding source address).

Generally, there's little gain in that and much confusion. Creating a tunnel to communicate using private IPs is a much better option. Private IP packets are encapsulated in public IP packets by Router#1, traverse the Internet, and are decapsulated by Router#2 - the original packets don't change.

Tunneling also enables more than two hosts to communicate transparently with just two public IP endpoints. Encryption is another option.