Suppose I have a network of 2 computers, each having a private network address of and

For my public ip address, it is

When I make a http request to google.com, my computer will send out a packet with source ip address of to the router and the NAT will change it to

My question is, when google.com gets the request, and sends the reply back to, how does the router knows which computer to route to? ( or

I was thinking about port number at first but I think that we could be browsing on the same website at the same time so I have no idea how it works here.

  • 1
    possible duplicate of UDP hole punching NAT port – Sebastian Wiesinger Mar 23 '15 at 7:46
  • 1
    The 10 network is also "internal non-routable" -- I'm working fast through the queue tonight, so maybe I'm bonkers... there's another layer of NAT must be happening to turn that 10 net number into a publick routable. Anyway... McKevin, welcome to Net Eng! This is a softball Q for here, but it's on topic enough I suppose... – Craig Constantine Mar 24 '15 at 1:39
  • @CraigConstantine I'm just a CCNA student, I guess that explains on the softball Q :) – Mc Kevin Mar 24 '15 at 2:04

If you are using static (one-to-one) NAT, the router will assign the public IP to the first PC ( for example ) trying to reach google.com. In this case, the two PC will not be able to communicate with google.com at once, because the only available public IP is already distributed.
The NAT table in the router: ->

In your case PAT ( NAT overloading ) is the solution.
With PAT, multiple addresses can be mapped to one private IP. When a device initiates a TCP/IP session, it generates a TCP or UDP source port number to uniquely identify the session. When the router receives this packet it uses that source port number to uniquely identify the translation.

PC1 ( makes an HTTP request to google.com ( with a random source port number (1444). PC1 will send a packet with DA: | SA: When the router receives this packet it inserts -> to the NAT table then changes the L3 addressing of the packet to DA: | SA: and forwards it to google.com.
Google responds with DA: | SA: The router receives this packet and translates it to DA: | SA: then forwards it to PC1.

If PC2 ( sends a packet with the same source port number as PC1 did , the router simply increases the port number by 1. In that case the NAT table would look like this -> ->

I hope it helps a bit.

As @CraigConstantine noticed, is still in the private address space so I have changed it to

  • so you mean we will be having 2 port numbers in the packet? one for the NAT and one for the terminal (http port 80)? – Mc Kevin Mar 23 '15 at 6:51
  • 1
    Yes. The PC sends a packet with <dest:, source>. The router translates it to <dest:, source:> and sends it to Google. Google responds with <dest:, source:>. The router receives the packet, searches for the mapping in the NAT table. Finds the correct row, translates, and sends the packet to the PC with <dest:, source:> – Adam Hornyak Mar 23 '15 at 7:00
  • 1
    Only one in the packet. the router re-writes the destination address and port numbers as it translates. – Ron Trunk Mar 23 '15 at 10:28
  • 1
    If we want to get all technical (and who wouldn't?) the PC does assign a source port which is then translated by the NAT device. So in Adam's comment the first source would really be more like, and likewise the corresponding final destination at the end of his comment would be – Todd Wilcox Mar 23 '15 at 12:25
  • 1
    @ToddWilcox You are right. I forgot that. I will update my answer. – Adam Hornyak Mar 23 '15 at 13:28

Your router knows where to route traffic because it maintains a table of stateful connections which are source IPaddress:port and destination IPaddress:port relationships. These are established based on your firewall rules, NAT policies, and a few other settings (like TCP and UDP timeout). There are 4 possible states: NEW, RELATED, ESTABLISHED and INVALID. Based on your firewall rules, your firewall determines what state a connection should be in. So typically, you can make NEW connections outbound by default, but only RELATED or ESTABLISHED connections are allowed inbound if you create a NAT or PAT rule and matching firewall policy to allow this.

Then, either based on the rules you have configured (for the case of a NEW connection) or the existing connection table (for the case of an ESTABLISHED connection) a packet will be allowed or disallowed through.

Furthermore, an [ARP] table is maintained which helps to firewall to know what physical MAC address an IP address corresponds to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.