What is the point of outside NAT?

Question

I understand how outside NAT works, but I do not know when it should be implemented? Could you please tell me some scenarios when outside NAT is needed?

Thanks!

Answer 1

First "outside" NAT is not a standard term. So it's really not clear what you are talking about.

Basically there's two direction for NAT: you will either change (translate) the source IP address or the destination IP address in a packet. (You can do both but this is required only in specific setup).

• Source NAT is the more common, it is mostly used to replace the internal, often private (I.E. RFC1918) IP address of a host and replace it with a public IP address to access the Internet. This is what is done by default in any home / small business router.

• Destination NAT, which is what you may referring to, replace the destination IP address with another one. The most basic case is to allow an internal server, with a private IP address, to be reachable from the Internet.

Example: you router has a public IP address of 198.51.100.17, your web server in your LAN has a private IP address 192.168.1.8 and you want it to be accessible from the Internet.

So you configure destination NAT and replace the destination IP address 198.51.100.17 in incoming packet on the outside interface of the router with the 192.168.1.8 address and the packets now reach the web server.

Another use is to interconnect (with VPN for example) two networks that use the same IP networks. To eliminate the duplicate addresses you need to perform NAT, and destination address NAT may be required.

Answer 2

Let's define a few terms first (I'm using Cisco's terms):

"Inside" are addresses in your network, behind the NAT device.

"Outside" are addresses everywhere else, e,g, the Internet, or another external connection.

Outside NAT translates the outside address into something compatible with the internal network.

As an example, I have a VPN connection to a vendor network, and the vendor uses private addresses that overlaps my address space. I translate the vendor addresses (outside) into a block that is unused in my address space, so I can route correctly.

Note that in this case, my particular host addresses using the VPN do not overlap the vendor. Otherwise I would have to NAT source and destination.