NAT

Network Address Translation rewrites address fields, and often transport ports, as packets cross a translating device. It is widely used to connect privately addressed IPv4 networks through a smaller set of externally routable addresses.

Source Translation

Source NAT replaces a packet's source address as it leaves a network. Many-to-one deployments also translate source ports so several internal flows can share one external address. This port-aware form is often called NAPT, PAT, or masquerading when the external address can change.

The translator tracks mappings so reply packets can be rewritten back to the original internal endpoint. It normally forwards the same transport flow; it does not have to open a separate proxy connection as an application proxy would.

Destination Translation

Destination NAT rewrites the destination address or port, commonly to publish an internal service through an external endpoint. A port-forward rule might map an external TCP port to a different internal address and port. Return traffic needs consistent reverse translation.

NAT and Firewall Policy

NAT is not a firewall. A stateful translator may lack a mapping for unsolicited inbound traffic, but explicit forwarding, destination translation, filtering, and application exposure determine what is reachable. Security policy should be expressed and audited with firewall rules, least-privilege services, and end-to-end controls rather than inferred from address rewriting.

Operational Consequences

NAT can exhaust address-and-port mappings, complicate peer-to-peer protocols, obscure original sources from applications, and require special handling for protocols that embed addresses. Logs must preserve translation timestamps and mapping details if flows need to be traced.

On Linux, modern policy is commonly configured with nftables and connection tracking. Inspect the actual ruleset before changing it:

$ sudo nft list ruleset
$ sudo conntrack -L

The second command requires conntrack tooling and privileges. Ruleset changes can disconnect remote access, so use console recovery, atomic configuration, validation, and rollback.

Summary

You can now distinguish address translation from routing, proxying, and firewall policy.

1. Identify source translation on outbound flows.
2. Identify destination translation in published services.
3. Understand how port mappings allow address sharing.
4. Apply explicit filtering instead of treating NAT as security.
5. Preserve mapping evidence and recovery access during changes.