How are UDP source ports mapped on a NAT?

Question

Here is an example use case; I am curious to see how this is suppose to work and why:

Someone has a NAT router from their ISP.

Behind the router are 2 PCs running Linux and using ntpd. ntpd sends UDP messages to servers with source and destination port both set to 123.

When the packets come out of the router (WAN port) and go to the NTP server, what should their src port be?

Is the router suppose to map the src on the LAN to a different src on the WAN so it knows how to map the responses?

If not, and they carry src 123 out to the internet, how does the router know which PC to send the reply to?

Answer 1

This depends on the NAT implementation.

In general, most NAT engines prefer to make as few modifications as necessary. So, the first one there gets to keep their src port. The second one is "the loser" and has it changed. The map entry doesn't depend on anything changing; it tracks whatever is used, changed or not. As long as they aren't both talking to the same server, they can both use the same src port, because the map includes the destination:

[(inside){src}PC A:123 {dst}Server A:123 :: (outside){src}ISP:123 {dst}Server A:123]
[(inside){src}PC B:123 {dst}Server B:123 :: (outside){src}ISP:123 {dst}Server B:123]
                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The outside details are different, thus a unique key to find the inside match.

Answer 2

how does the router know which PC to send the reply to?

To answer the above point NAT table generate random port as a reference to souce PC in router and save in NAT table .

Source ip address : Destination ip address Source mac -address Destination mac -address Source port Destination port

So this souce port will destined correctly to return traffic to correct source from where this traffic is generated initially .