I understand how outside NAT works, but I do not know when it should be implemented? Could you please tell me some scenarios when outside NAT is needed?



2 Answers 2


First "outside" NAT is not a standard term. So it's really not clear what you are talking about.

Basically there's two direction for NAT: you will either change (translate) the source IP address or the destination IP address in a packet. (You can do both but this is required only in specific setup).

  • Source NAT is the more common, it is mostly used to replace the internal, often private (I.E. RFC1918) IP address of a host and replace it with a public IP address to access the Internet. This is what is done by default in any home / small business router.

  • Destination NAT, which is what you may referring to, replace the destination IP address with another one. The most basic case is to allow an internal server, with a private IP address, to be reachable from the Internet.

Example: you router has a public IP address of, your web server in your LAN has a private IP address and you want it to be accessible from the Internet.

So you configure destination NAT and replace the destination IP address in incoming packet on the outside interface of the router with the address and the packets now reach the web server.

Another use is to interconnect (with VPN for example) two networks that use the same IP networks. To eliminate the duplicate addresses you need to perform NAT, and destination address NAT may be required.

  • Meet me in chat?
    – Ron Trunk
    Commented Jul 20, 2018 at 12:26

Let's define a few terms first (I'm using Cisco's terms):

"Inside" are addresses in your network, behind the NAT device.

"Outside" are addresses everywhere else, e,g, the Internet, or another external connection.

Outside NAT translates the outside address into something compatible with the internal network.

As an example, I have a VPN connection to a vendor network, and the vendor uses private addresses that overlaps my address space. I translate the vendor addresses (outside) into a block that is unused in my address space, so I can route correctly.

Note that in this case, my particular host addresses using the VPN do not overlap the vendor. Otherwise I would have to NAT source and destination.

  • 1
    The same concept can also be used from the service provider side. A company I used to work for called this "normalization NAT". They were a SP with dozens of customers connecting with RFC 1918, public or even Iillegal/rogue public (source) IP ranges over variuos connectivity services. To make sure that they could connect inbound and that the reply packets were properly returned to them, they assigned a range of their own (internal) adresses, and had the border routers or CPEs NAT the traffic accordingly, circumventing all address overlap trouble. Commented Jul 20, 2018 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.