Does NAT change the L3-Encapsulation at all?

Question

Let's say that a packet I sent requesting for a https server successfully reaches my target (NAT) router.

The router receives it and through port-forwarding/triggering policies, it knows it has to send to Server-1 with IP address 192.168.0.100 at port 443. But the packet that it received has a L3-Encapsulation of Source Router Public IP(ME) and Destination Router Public IP(THEM). I know that it encapsulates the packet with a new frame, which is a new Source Mac and Destination Mac to send through the LAN and find the correct device. But I've heard the L3-Encapsulation do not change. Is that true?

Does that mean server-1 receives a packet that will just have the old L3-Encapsulation that has two public IP Address, or does it change to its own private IP which is 192.168.0.100 and the router's private IP of 192.168.0.1?

Answer 1

Does that mean server-1 receives a packet that will just have the old L3-Encapsulation that has two public IP Address, or does it change to its own private IP which is 192.168.0.100 and the router's private IP of 192.168.0.1?

In the scenario you described, the target (NAT) router modifies the layer 3 information (IP addresses) according to the NAT policy, in addition to removing and replacing the layer 2 information that is done as part of normal routing.

In a typical static NAT, the packet's destination address is modified to match to address of the real server address. The return packet is modified in the reverse way, so that the real address of the server is replaced by the NAT address.

The result is that both the source device and destination server are unaware that NAT is taking place. The source sends the traffic to the NAT address, and the traffic it receives comes from that same address.

The server receives the packet addressed to it, and is unaware that the router modified the destination address.

As other have pointed out, while this is a very common NAT scenario, there are many other ways of using NAT.

Answer 2

... reaches my target router

I assume you mean your WAN router that uses the address that the packet is addressed for (with IPv4 NAT). Normally, the destination is never a router but a host.

But the packet that it received has a L3-Encapsulation of Source Router Public IP(ME) and Destination Router Public IP(THEM).

No. The packet is only encapsulated by an L2 frame (addressed from the last hop router to your current router, usually by MAC). The IP packet in turn encapsulates a TCP segment (or anything else from a higher-layer protocol). Generally, an IP packet is addressed from the source host to the destination host, period.

Only with IPv4 and NAT do you need translation. In your case, there's destination NAT from public IP space to a private host. The NAT router requires a port-forwarding rule. Since the packet is addressed to the router's own public IP and L4 port (fitting the rule), it translates publicIP:publicPort to privateIP:privatePort on the actual server. Then it forwards the packet.

MAC addresses are only required when the packet needs to cross a MAC-based network like Ethernet. The router ARPs the host IP and uses that MAC address as destination for the encapsulating frame.