Let's say I have a private network connected to the internet with default gateway on Router1. Now a host(Host#1, on this network wants to send a packet over the public internet to a host(Host#2, on another private network with RouterB as its default gateway. The packets from network gets NATed to, say,, and for network it is

Here is what I feel how the packet will flow

  1. Host#1 creates a packet with source and destination IP as and (I'm not sure about this. Will the destination IP be the public or private IP of Host#2?).
  2. Packet reaches Router1 and gets NATed to the public IP addresses and
  3. Packet reaches Router2.
  4. Now Router2 sees a packet coming from directed to How does it know which host it has to route the packet to.

I'll also add that I'm talking about PAT here specifically.

1 Answer 1


For public Internet traversal, NAT is not a good option.

When exiting Router#1 you'd first have to SNAT the source IP to (with or without NATing the source TCP/UDP port as well). On arrival on Router#2 you'd have to DNAT the destination IP to

If Host#1 used Host#2'2 private IP as destination instead, Router#1 would also have to DNAT to and Router#2 would change that back.

How does it know which host it has to route the packet to?

Exactly. For both hosts to communicate transparently, you'd need static NAT with a 1:1 mapping of public to private IPs (in contrast to just port forwarding for a single service). You cannot use the public IPs for anything else (unless you create specific mappings by corresponding source address).

Generally, there's little gain in that and much confusion. Creating a tunnel to communicate using private IPs is a much better option. Private IP packets are encapsulated in public IP packets by Router#1, traverse the Internet, and are decapsulated by Router#2 - the original packets don't change.

Tunneling also enables more than two hosts to communicate transparently with just two public IP endpoints. Encryption is another option.

  • Thankyou. That clears a lot. One question- "Router#1 would also have to DNAT to and Router#2 would change that back.", What do you mean by DNAT to x.x.x.x? Isn't that just static NAT?
    – P_K
    Commented Feb 26, 2019 at 9:39
  • With Host#1 using as destination, Router#1 would have to translate that destination to for the Internet traversal. Router#2 would then translate the destination back to - both are using static NAT. In the reverse direction you'd have the same problem.
    – Zac67
    Commented Feb 26, 2019 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.