How Does Network Address Translation Work Initially at the End Point Router

Question

I have come across a question that I can not seem to get a quality answer to. I understand how NAT works when a reply packet is received and how it is mapped back to an internal IP address from the global IP address. But I am still unclear how it works initially. To make my question more clear, I am going to use the example network shown on page 512 of this textbook. When Alice is initially trying to communicate with Bob, how does Bob's router map the packets coming from Alice to his local IP address, and not the other two computers on his LAN? I am confused because I do not understand how the Global IP address at Bob's router knows how to route those packets to him.

Answer 1

The diagram in your question does not show any use of NAT, so it's not too good a choice. If we assume that R2 is using source NAT/NAPT, and R7 is using destination NAT aka port forwarding, then

1. Alice addresses the packet to Bob's public router R7. Bob's private address is unknown to Alice and useless.
2. R2 substitutes (one of) its public IP address for Alice's private source IP (and usually changes the source TCP port as well).
3. The packet is forwarded across the Internet / public IP space.
4. R7 substitutes Bob's private IP address for its own public destination IP (it may also change the destination TCP port), according to its DNAT mapping table.
5. The packet is forwarded to Bob.

When Bob replies,

1. R7 substitutes its own public IP for Bob's private source IP, according to its NAT table (and possibly the source port as well).
2. The packet is forwarded across the Internet.
3. R2 substitutes Alice's private IP for its own public destination IP, according to its NAT table.
4. The packet is forwarded to Alice.

[edit] Note that Alice has no way of addressing Bob directly since both exist in different private-address networks. The proper end-to-end design of TCP/IP requires a common, unambiguous address space between end nodes - which the mixing of public and private addressing breaks. SNAT and DNAT are remedies to - somewhat - solve that problem, albeit in a limited fashion.

Another option is to create a tunnel between R2 and R7, allowing them to share a common, private addressing scheme.

In contrast, IPv6 has a much better design, allowing simultaneous use of public, unambiguous and private, locally use addresses, so there's no need for NAT any more.

Answer 2

It is difficult to understand from the photo the type of NAT or PAT that is occurring in the scenario. Which makes it difficult to answer your question exactly.

There are four types of translations: Static NAT, Static PAT, Dynamic PAT, Dynamic NAT.

Of those four, Dynamic PAT is uni-directional. Meaning connections will only flow through the translation if the traffic is initiated by the internal host.

The other three types of translations are bi-directional, meaning intrinsic to how that NAT operates or is configured, the Router has a mapping to use for connections initiated in both direction.

I discuss Dynamic PAT being Unidirectional in this answer (quoted below):

There are four ways address translation can occur:

• Static NAT – Translation of just the IP address where the administrator explicitly defines the IP address after translation
• Static PAT – Translation of the IP address and Port, where the administrator explicitly defines the IP address and Port after
  translation
• Dynamic PAT – Translation of the IP address and Port, where the router determines the new IP address and Port after translation
• Dynamic NAT – Translation of just the IP address, where the router determines the new IP address after translation

(These go by different names depending on which vendor's document you are reading)

All but one of these types of translation are Bidirectional -- traffic can be be processed by the translation whether it is initiated from an internal host or an external host.

The one that isn't (Dynamic PAT) is Unidirectional -- traffic flows only if the internal host initiated the traffic.

You didn't explicitely indiciate which type of translation you are referring to, but I think it is safe to say you are speaking about a Dynamic PAT. To that end, the question you are actually asking is ...

Why is a Dynamic PAT unidirectional?

To understand, you must first look at how a Dynamic PAT process traffic. First, let's look at outbound traffic:

As the internal hosts send traffic through the device configured with a Dynamic PAT, the device translates the Source IP and Source Port, then sends the packet along.

The original packet attributes and translated packet attributes are logged in the translation table.

On the way back in, the return packet is matched against the translation table to determine how to "untranslated" the packet and send it to the correct initiating host:

Notice the response traffic of the original request is allowed back through the translation device (the Router, in this case, but many devices can do a Dynamic PAT) because the entry in the Translation table existed.

If, however, traffic is initiated externally towards the Dynamic PAT IP address:

The Router will have no entry in the translation table, and will therefore not know which of the internal hosts (A, B, or C) to send the packet to. Therefore, all the Router can do with it is drop the packet.