I have come across a question that I can not seem to get a quality answer to. I understand how NAT works when a reply packet is received and how it is mapped back to an internal IP address from the global IP address. But I am still unclear how it works initially. To make my question more clear, I am going to use the example network shown on page 512 of this textbook. When Alice is initially trying to communicate with Bob, how does Bob's router map the packets coming from Alice to his local IP address, and not the other two computers on his LAN? I am confused because I do not understand how the Global IP address at Bob's router knows how to route those packets to him. enter image description here


The diagram in your question does not show any use of NAT, so it's not too good a choice. If we assume that R2 is using source NAT/NAPT, and R7 is using destination NAT aka port forwarding, then

  1. Alice addresses the packet to Bob's public router R7. Bob's private address is unknown to Alice and useless.
  2. R2 substitutes (one of) its public IP address for Alice's private source IP (and usually changes the source TCP port as well).
  3. The packet is forwarded across the Internet / public IP space.
  4. R7 substitutes Bob's private IP address for its own public destination IP (it may also change the destination TCP port), according to its DNAT mapping table.
  5. The packet is forwarded to Bob.

When Bob replies,

  1. R7 substitutes its own public IP for Bob's private source IP, according to its NAT table (and possibly the source port as well).
  2. The packet is forwarded across the Internet.
  3. R2 substitutes Alice's private IP for its own public destination IP, according to its NAT table.
  4. The packet is forwarded to Alice.

[edit] Note that Alice has no way of addressing Bob directly since both exist in different private-address networks. The proper end-to-end design of TCP/IP requires a common, unambiguous address space between end nodes - which the mixing of public and private addressing breaks. SNAT and DNAT are remedies to - somewhat - solve that problem, albeit in a limited fashion.

Another option is to create a tunnel between R2 and R7, allowing them to share a common, private addressing scheme.

In contrast, IPv6 has a much better design, allowing simultaneous use of public, unambiguous and private, locally use addresses, so there's no need for NAT any more.

| improve this answer | |
  • So I guess what I am confused by is, is there something in the packet that Alice is sending to Bob, besides his routers Global IP, that is saying "hey this is meant for Bob" and not the other devices on the LAN? – B. Lowe Apr 1 at 15:08
  • Actually, no. Alice has no way of addressing Bob directly since they don't have a common, contiguous address space. NAT is said to "break the end-to-end paradigm" since not only the end nodes control the traffic. The only entity really addressing Bob is R7 which requires a port forwarding setup. If you do need Alice to address Bob directly across different private networks you need to forget about NAT and create a tunnel. Fortunately, IPv6 does away with all that NAT ambiguity... – Zac67 Apr 1 at 17:18
  • Alice only knows Bob's router IP, and is even unaware that Bob is using NAT. Since Bob has created a static translation (port forwarding) on his router (R7), the destination address in Alice's message gets translated to Bob's private IP – Ron Trunk Apr 1 at 18:07
  • Then my next question is, how does Alice know what port she is to be connecting to so that her packet will be forwarded to Bob once it gets to his router (R7)? – B. Lowe Apr 1 at 18:50
  • Alice needs to know the port on R7 she can connect to Bob on. Usually, that's the same port that Bob is using but not necessarily so (R7 can simply translate the L4 port along with the.IP address). – Zac67 Apr 1 at 19:33

It is difficult to understand from the photo the type of NAT or PAT that is occurring in the scenario. Which makes it difficult to answer your question exactly.

There are four types of translations: Static NAT, Static PAT, Dynamic PAT, Dynamic NAT.

Of those four, Dynamic PAT is uni-directional. Meaning connections will only flow through the translation if the traffic is initiated by the internal host.

The other three types of translations are bi-directional, meaning intrinsic to how that NAT operates or is configured, the Router has a mapping to use for connections initiated in both direction.

I discuss Dynamic PAT being Unidirectional in this answer (quoted below):

There are four ways address translation can occur:

  • Static NAT – Translation of just the IP address where the administrator explicitly defines the IP address after translation
  • Static PAT – Translation of the IP address and Port, where the administrator explicitly defines the IP address and Port after
  • Dynamic PAT – Translation of the IP address and Port, where the router determines the new IP address and Port after translation
  • Dynamic NAT – Translation of just the IP address, where the router determines the new IP address after translation

(These go by different names depending on which vendor's document you are reading)

All but one of these types of translation are Bidirectional -- traffic can be be processed by the translation whether it is initiated from an internal host or an external host.

The one that isn't (Dynamic PAT) is Unidirectional -- traffic flows only if the internal host initiated the traffic.

You didn't explicitely indiciate which type of translation you are referring to, but I think it is safe to say you are speaking about a Dynamic PAT. To that end, the question you are actually asking is ...

Why is a Dynamic PAT unidirectional?

To understand, you must first look at how a Dynamic PAT process traffic. First, let's look at outbound traffic:

Practical Networking :: Dynamic PAT :: Outbound

As the internal hosts send traffic through the device configured with a Dynamic PAT, the device translates the Source IP and Source Port, then sends the packet along.

The original packet attributes and translated packet attributes are logged in the translation table.

On the way back in, the return packet is matched against the translation table to determine how to "untranslated" the packet and send it to the correct initiating host:

Practical Networking :: Dynamic PAT :: Inbound Response Traffic

Notice the response traffic of the original request is allowed back through the translation device (the Router, in this case, but many devices can do a Dynamic PAT) because the entry in the Translation table existed.

If, however, traffic is initiated externally towards the Dynamic PAT IP address:

Practical Networking :: Dynamic PAT :: Inbound Initial Traffic

The Router will have no entry in the translation table, and will therefore not know which of the internal hosts (A, B, or C) to send the packet to. Therefore, all the Router can do with it is drop the packet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.