1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain what Network Address Translation (NAT) is.
• Understand private and public IPv4 addresses.
• Explain how NAT translates IP addresses.
• Differentiate between Static NAT and Dynamic NAT.
• Understand PAT (Port Address Translation) and NAT Overload.
• Explain how private devices share a public IP address.
• Understand port forwarding and its security implications.
• Identify Double NAT scenarios.
• Differentiate between NAT and a firewall.
• Troubleshoot common NAT connectivity problems.
• Identify security risks associated with incorrect NAT configuration.
• Design a basic NAT configuration for an enterprise network.

2. What Is NAT?

NAT stands for Network Address Translation.

NAT is a networking technique that modifies IP address information in packet headers as traffic passes through a network device, commonly a router or firewall.

It is frequently used to translate private IPv4 addresses into public IPv4 addresses.

Why Do We Need NAT?

IPv4 uses a 32-bit address space.

The number of available IPv4 addresses is limited, and organizations commonly use private IP address ranges for internal networks.

Private IP addresses are not directly routable across the public internet.

NAT allows multiple private network devices to communicate with external networks using one or more public IP addresses.

Real-world example

Imagine an office has 50 employees.

Each employee has a private IP address:

• Laptop 1: 192.168.1.10
• Laptop 2: 192.168.1.11
• Laptop 3: 192.168.1.12
• Laptop 4: 192.168.1.13

The office router has a public IP address:

203.0.113.10

When employees access the internet, the router can translate their private source addresses into its public address.

Multiple employees can share that public address using PAT.

Key concept: NAT changes address information to allow communication between networks using different addressing environments.

3. Private IP Addresses vs Public IP Addresses

Before understanding NAT, you must understand private and public IP addresses.

3.1 Private IP Addresses

Private IPv4 addresses are reserved for use within private networks.

The three RFC 1918 private IPv4 ranges are:

These addresses can be reused by different organizations because they are not globally unique.

Examples:

• 192.168.1.10
• 10.10.10.25
• 172.16.5.20

3.2 Public IP Addresses

A public IP address is globally routable on the internet, subject to routing and network policies.

Examples of documentation-only IPv4 addresses include:

• 203.0.113.10
• 198.51.100.20
• 192.0.2.50

These addresses are reserved for examples and documentation. They are not ordinary public service addresses.

Private vs Public IP

Important: NAT is not required for every private network to communicate with another network. Private networks can also communicate through private routing, VPNs, or other network designs.

4. How NAT Works

Consider this network:

Laptop A wants to access a public website.

Simplified NAT Process

Step 1 – Original packet

Laptop A creates a packet:

• Source IP: 192.168.1.10
• Destination IP: 198.51.100.20

Step 2 – Router receives the packet

The office router receives the traffic from the internal network.

Step 3 – Translation

The router changes the source IP address to its public IP address.

• Original source: 192.168.1.10
• Translated source: 203.0.113.10

Step 4 – Packet travels to the internet

The external server receives the packet with the translated public source address.

Step 5 – Response arrives

The server sends its response to 203.0.113.10.

Step 6 – Reverse translation

The router uses its NAT translation information to identify the original internal destination and forwards the response to Laptop A.

Key concept: NAT maintains the information needed to associate translated traffic with the original internal communication.

5. Types of NAT

Three important NAT categories are:

1. Static NAT.
2. Dynamic NAT.
3. PAT (Port Address Translation).

Each one has a different purpose.

6. Static NAT

Static NAT creates a fixed one-to-one mapping between a private IP address and a public IP address.

The mapping remains configured until an administrator changes it.

Example

An organization has an internal application server:

192.168.10.10

It is assigned a public address:

203.0.113.10

The mapping is:

When traffic passes through the NAT device, the configured mapping is applied.

How Static NAT Works

1. An internal server sends traffic.
2. The NAT device checks its translation configuration.
3. The private IP is translated to the assigned public IP.
4. Return traffic is translated back to the internal address.

Advantages

• Predictable address mapping.
• Useful when a device needs a consistent public address.
• Easier to identify the public-to-private address relationship.
• Useful in certain server and partner connectivity designs.

Disadvantages

• Requires a dedicated public IP for each mapping in typical one-to-one deployments.
• Public address resources may be limited.
• Does not automatically provide application-level security.
• A static mapping alone does not make an internal service safe to expose.

Important: Static NAT does not automatically mean that an internal server is reachable from the internet. Firewall rules and routing policies still determine whether inbound traffic is permitted.

7. Dynamic NAT

Dynamic NAT uses a pool of public IP addresses.

Instead of assigning one permanent public address to each internal device, the NAT device selects an available public address from the configured pool when a translation is needed.

Example

An organization has these public IP addresses available:

• 203.0.113.10
• 203.0.113.11
• 203.0.113.12

Internal devices:

• 192.168.1.10
• 192.168.1.11
• 192.168.1.12

The NAT device can dynamically assign an available public address to an internal device.

These are illustrative translations, not permanent assignments.

How Dynamic NAT Works

1. An internal device initiates a connection.
2. The NAT device checks its public IP pool.
3. It selects an available public address.
4. It creates a translation entry.
5. Return traffic is mapped to the original private address.
6. The mapping is released according to the device's translation behavior and configured timeout.

Advantages

• Uses a public IP pool efficiently compared with permanently assigning one address to every device.
• Provides flexible address allocation.
• Useful for networks with multiple public IP addresses.

Disadvantages

• Requires a pool of public IP addresses.
• The pool can become exhausted.
• Public IP assignment is not necessarily predictable.
• Does not provide the same level of many-to-one address sharing as PAT.

8. What Is PAT?

PAT stands for Port Address Translation.

PAT is a form of NAT that uses transport-layer port information to allow multiple internal devices to share one public IP address.

It is also commonly called:

• NAT Overload.
• Many-to-One NAT.

PAT is widely used in home and office networks.

8.1 Why Do We Need PAT?

Imagine an office has 100 devices.

The organization has only one public IPv4 address.

How can all 100 devices communicate with the internet?

PAT solves this by translating both address and port information.

Example

Three internal devices access external services.

The router has one public IP:

203.0.113.10

It creates distinct translation entries:

These are illustrative port mappings.

Even though all three devices share the same public IP address, the router uses port information and its translation state to distinguish the connections.

8.2 How PAT Works

1. An internal device initiates a connection.
2. The NAT device receives the packet.
3. It identifies the source IP and transport-layer port.
4. It replaces the private source IP with the public IP.
5. It assigns or maintains a suitable translated port.
6. It records the translation in its state table.
7. Response packets are matched to the correct entry.
8. The original private destination information is restored.

Advantages

• Many devices can share one public IPv4 address.
• Reduces the number of public IPv4 addresses required.
• Commonly supported by home and enterprise routers.
• Helps accommodate IPv4 address scarcity.

Disadvantages

• Requires translation state to be maintained.
• Port resources and device capacity are finite.
• Some applications may require special NAT traversal support.
• Can complicate peer-to-peer connections.
• Makes direct inbound connectivity more complicated.

9. Static NAT vs Dynamic NAT vs PAT

Remember:

• Static NAT = fixed mapping.
• Dynamic NAT = public address selected from a pool.
• PAT = multiple private devices share public IP addresses using port information.

10. What Is Port Forwarding?

Port forwarding is a configuration that directs incoming traffic received on a particular public IP address and port to a specific internal device and port.

It is commonly implemented using destination NAT (DNAT).

Real-world example

An organization hosts an internal web application.

Internal server:

192.168.10.20

Internal service:

TCP port 443

Public address:

203.0.113.10

An administrator configures an inbound mapping:

203.0.113.10:443 → 192.168.10.20:443

When approved external HTTPS traffic arrives at the public address and port, the router or firewall forwards it to the internal web server.

10.1 How Port Forwarding Works

1. An external client connects to the public IP and configured port.
2. The router or firewall receives the connection.
3. It checks the port-forwarding rule.
4. The destination address and possibly destination port are translated.
5. The traffic is forwarded to the internal server.
6. The server processes the request.
7. Return traffic is handled using the appropriate NAT and connection state.

10.2 Common Port Forwarding Examples

These examples do not mean that every service should be exposed directly to the internet.

Security Risks

Incorrect port forwarding can expose:

• Remote desktop services.
• SSH administration interfaces.
• Database services.
• Internal management panels.
• Unpatched web applications.
• IoT administration interfaces.

Port Forwarding Best Practices

1. Expose only services that are genuinely required.
2. Prefer a VPN or Zero Trust access gateway for administrative access.
3. Avoid exposing database ports directly.
4. Restrict source IP addresses where practical.
5. Use strong authentication and MFA.
6. Keep exposed applications patched.
7. Enable firewall logging.
8. Review forwarding rules regularly.
9. Remove obsolete mappings.
10. Monitor unusual inbound connection attempts.

Important: Port forwarding is a traffic-delivery configuration, not a security control.

11. What Is Double NAT?

Double NAT occurs when traffic passes through two separate devices that both perform NAT.

Example

A home network has:

• ISP modem/router.
• Personal Wi-Fi router.
• Laptop.

Both routers perform NAT.

Network path:

Laptop → Personal Router → ISP Router → Internet

The laptop's private traffic is translated by the personal router, then translated again by the ISP router.

Why Does Double NAT Happen?

Common reasons include:

• ISP-provided router combined with a personal router.
• Multiple routers configured in routing mode.
• Some network designs using separate NAT gateways.
• ISP carrier-grade NAT combined with customer NAT.

Common Problems

Double NAT can complicate:

• Port forwarding.
• Hosting services.
• Peer-to-peer applications.
• Some gaming and voice/video applications.
• VPN connectivity.
• Network troubleshooting.

It does not necessarily break normal web browsing.

How to Identify Double NAT

Inspect the WAN address of your personal router.

If its WAN address belongs to a private address range or the shared CGNAT range, another upstream translation layer may exist.

Important ranges to recognize:

• RFC 1918 private ranges.
• 100.64.0.0/10 – Shared address space commonly used for carrier-grade NAT.

The presence of a private WAN address suggests another upstream router or private network. It does not alone prove that two NAT devices are present; the upstream network may use private routing.

How to Reduce Double NAT Problems

Possible approaches include:

• Configure the upstream device in bridge mode if supported and appropriate.
• Configure the downstream router as an access point.
• Coordinate port forwarding across both NAT devices where necessary.
• Request a public IP service from the ISP if inbound connectivity is required.
• Use an appropriate VPN or relay-based solution instead of exposing internal services.

Security consideration: Bridge mode changes the network's security boundary. Ensure that an appropriate firewall remains in place.

12. NAT vs Firewall

NAT and firewalls are related in many network devices, but they perform different functions.

NAT

NAT modifies address or port information in network packets.

Its primary purposes include address translation and connectivity between addressing environments.

Firewall

A firewall enforces traffic policies by allowing, denying, or otherwise controlling network communication.

It can inspect traffic based on:

• Source IP.
• Destination IP.
• Source port.
• Destination port.
• Protocol.
• Connection state.
• Application information, depending on firewall type.

Comparison

Important Security Concept

A device using NAT does not automatically provide complete firewall protection.

Many home routers combine NAT and stateful firewall functions in the same device, which can create confusion.

An organization should explicitly configure firewall policies rather than assume that NAT alone blocks all unwanted traffic.

13. NAT and Network Security

NAT can influence network exposure, but it should not be treated as a replacement for security controls.

13.1 Inbound Exposure

Port-forwarding rules can make internal services reachable from external networks.

This increases the attack surface.

Defense:

• Minimize inbound mappings.
• Use a firewall.
• Restrict source networks.
• Patch exposed services.
• Monitor inbound traffic.

13.2 NAT Table Exhaustion

NAT devices maintain translation state for active connections.

A very large number of connections can consume available resources.

Possible effects:

• New connections fail.
• Existing sessions become unstable.
• Router performance degrades.

Defense:

• Monitor connection-table usage.
• Apply appropriate rate limits.
• Maintain updated network equipment.
• Investigate abnormal connection patterns.
• Use suitable capacity planning.

13.3 NAT Traversal Challenges

NAT can make direct communication between devices more difficult.

This affects some applications such as:

• Voice over IP.
• Video conferencing.
• Peer-to-peer communication.
• Some VPN technologies.

Applications may use NAT traversal techniques such as STUN, TURN, or ICE, depending on the service architecture.

13.4 Misconfigured NAT Rules

Incorrect NAT rules can:

• Redirect traffic to unintended servers.
• Break application connectivity.
• Expose management services.
• Create unexpected network paths.

Defense: Maintain documented NAT rules and review them during configuration changes.

14. NAT Troubleshooting

Network administrators need to identify whether connectivity problems are caused by NAT, routing, DNS, firewall rules, or the destination service.

Scenario 1: Internal Device Cannot Access the Internet

Possible causes:

• Missing NAT rule.
• Incorrect default gateway.
• Missing route.
• Firewall blocking outbound traffic.
• ISP connectivity issue.
• Incorrect WAN configuration.

Useful checks:

Windows:

ipconfig /all
route print

Linux:

ip addr
ip route

Scenario 2: Port Forwarding Is Not Working

Possible causes:

• Incorrect public IP.
• Wrong external port.
• Wrong internal destination IP.
• Internal server is offline.
• Service is not listening.
• Firewall blocks the connection.
• Double NAT.
• ISP blocks inbound connections.
• Carrier-grade NAT prevents direct inbound reachability.

Scenario 3: Some Applications Work, Others Fail

Possible causes:

• Incorrect NAT timeout settings.
• Application-specific NAT traversal requirements.
• Firewall restrictions.
• Incorrect MTU or fragmentation handling.
• Unsupported network protocol behavior.

Scenario 4: Public IP Address Is Not Directly Assigned to the Router

Possible causes:

• ISP uses carrier-grade NAT.
• An upstream router performs NAT.
• The customer router is in access-point or bridge mode.
• The network uses a private WAN arrangement.

Troubleshooting Checklist

1. Confirm the device's IP configuration.
2. Confirm the default gateway.
3. Verify local network connectivity.
4. Verify internet connectivity using an approved destination.
5. Inspect the NAT translation table.
6. Review firewall policies.
7. Verify the destination service is running.
8. Check port-forwarding rules if relevant.
9. Inspect upstream NAT and ISP configuration.
10. Review logs for rejected or failed traffic.

15. Enterprise NAT Design Example

Imagine CYNARKS operates a small office with:

• 20 employee devices.
• 5 guest devices.
• 2 application servers.
• 1 database server.
• 2 administrators.
• One internet connection.

A possible design:

Recommended NAT and Firewall Policies

Employee VLAN

• Allow approved outbound internet access through PAT.
• Allow access to approved internal applications.
• Restrict direct database access.

Guest VLAN

• Allow internet access through PAT.
• Block access to internal networks.
• Prevent unauthorized communication with employee devices.

Application VLAN

• Allow required outbound communication.
• Accept approved application traffic.
• Avoid unnecessary inbound public exposure.

Database VLAN

• No direct public NAT mapping.
• Accept database connections only from approved application servers and administrators.

Management VLAN

• Restrict management access to authorized devices.
• Avoid direct public access.
• Use VPN or approved secure administrative access.

Security principle: NAT handles address translation, while firewall policies enforce which communications are permitted.

16. Practical Lab 1: Identify Your Private IP Address

Objective: Identify your computer's private network address.

Windows

ipconfig

For complete interface details:

ipconfig /all

Linux

ip addr

macOS

ifconfig

Tasks

1. Identify your active network interface.
2. Record its IPv4 address.
3. Identify its subnet mask or prefix.
4. Identify the default gateway.
5. Determine whether the address belongs to an RFC 1918 private range.

Expected outcome: Understand how private IP addressing is used in local networks.

17. Practical Lab 2: Inspect Your Router's WAN and LAN Addresses

Objective: Understand the difference between the router's internal and external network configuration.

Use the administration interface of a router you own or are authorized to manage.

Record:

Tasks

1. Identify the router's LAN IP.
2. Identify its WAN IP.
3. Compare the two addresses.
4. Determine whether the WAN IP is private, shared, or globally routable.
5. Investigate whether an upstream NAT device may exist.

Do not share your public IP address or router administration screenshots publicly.

18. Practical Lab 3: Observe NAT Translation

Objective: Understand how an authorized NAT device records active connections.

If your router provides a NAT or connection tracking table, inspect it using its official administration interface.

For a Linux router or lab gateway with permission:

sudo conntrack -L

On supported systems, a summary can be viewed with:

sudo conntrack -S

Tasks

1. Generate ordinary outbound traffic from your own device.
2. Inspect the NAT or connection tracking table.
3. Identify the original source address.
4. Identify the translated source address where displayed.
5. Observe the protocol and connection state.
6. Explain how return traffic is associated with the original connection.

Expected outcome: Understand the role of NAT translation state.

Availability and output depend on the router platform and installed tools.

19. Practical Lab 4: Understand Port Forwarding with a Controlled Lab

Objective: Understand destination NAT without exposing a real production service.

Environment: An isolated virtual network or a local lab you own.

Lab Design

• Lab gateway: 192.168.50.1
• Internal test server: 192.168.50.10
• Test service: TCP port 8080
• Simulated external client: Separate isolated test network

Tasks

1. Start a simple test service on the internal lab server.
2. Confirm local access to the service.
3. Configure a temporary forwarding rule on the lab gateway.
4. Test access from the isolated external test client.
5. Review the gateway's translation and firewall logs.
6. Remove the forwarding rule after testing.

Expected outcome: Understand how external traffic can be directed to a private server.

Do not expose an actual database, management panel, or production server to the internet for this exercise.

20. Practical Lab 5: NAT Security Audit

Objective: Review NAT and port-forwarding rules in an authorized environment.

Use your own router or a designated lab firewall.

Review:

Deliverable

Prepare a short NAT assessment report containing:

• Network topology.
• NAT type in use.
• Translation rules.
• Externally exposed services.
• Potential misconfigurations.
• Risk ratings.
• Recommended remediation.

22. Lesson Summary

In this lesson, you learned:

• NAT modifies IP address or port information as traffic passes through a network device.
• Private IPv4 addresses are used within internal networks.
• Public IPv4 addresses are globally routable when properly allocated and announced.
• Static NAT provides fixed one-to-one mapping.
• Dynamic NAT selects public addresses from an available pool.
• PAT allows multiple internal devices to share a public IP address using port information.
• Port forwarding directs selected inbound traffic to an internal destination.
• Double NAT occurs when traffic passes through multiple NAT layers.
• NAT and firewalls have different responsibilities.
• NAT can complicate inbound connectivity, peer-to-peer communication, and VPN operation.
• Incorrect NAT configuration can expose internal services.
• Secure NAT design requires firewall policies, minimal exposure, monitoring, and regular configuration reviews.

23. Coming Next: Network Protocols and Services

In the next lesson, you will learn about the network protocols and services commonly used in enterprise environments.

Topics include:

• SSH and Telnet.
• FTP, SFTP, and FTPS.
• SMTP, POP3, and IMAP.
• SMB and NFS.
• SNMP.
• NTP.
• LDAP and Kerberos.
• Secure vs insecure protocols.
• Service exposure and hardening.
• Common protocol security risks.

CYNARKS Academy – Learn to Understand. Practice to Defend.

Practice networking and security testing only on systems you own or have explicit authorization to test.