NAT (Network Address Translation)

NAT rewrites IP addresses (and ports) as packets cross the firewall.

Why?

• IPv4 exhaustion: many private IPs share one public.
• Privacy: hide internal topology.
• Load balancing: distribute traffic across backends.

SNAT (Source NAT, aka masquerading):

• Outbound: client at 10.0.0.5 → 8.8.8.8.
• Firewall rewrites src to public IP: 198.51.100.1 → 8.8.8.8.
• Tracks: (10.0.0.5, port_X) ↔ (198.51.100.1, port_Y).
• Inbound reply: 8.8.8.8 → 198.51.100.1, port_Y. Firewall rewrites back to 10.0.0.5.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

POSTROUTING: chain for after routing decision. MASQUERADE: dynamic SNAT (uses outgoing interface's IP).

DNAT (Destination NAT, aka port forwarding):

• External request: client → 198.51.100.1:80.
• Firewall rewrites dst: client → 10.0.0.5:8080 (internal server).
• Internal server replies to client (via firewall's SNAT for return).

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080

1:1 NAT: one public IP maps to one private IP.

Hairpin NAT (NAT loopback):

• Internal client tries public IP.
• Firewall must rewrite both src and dst (so reply comes back to internal client).
• Tricky; some firewalls don't support.

Cone vs symmetric NAT:

• Full cone: same internal port → same external port for all destinations.
• Restricted cone: same external port, but only replies from contacted dst allowed.
• Symmetric: different external port per (dst_ip, dst_port). Defeats hole punching.

Modern home routers: typically restricted cone NAT. Workable for P2P + STUN.

NAT is layer 3+4 mangling. Doesn't understand L7 (e.g., FTP control mentioning data port). FTP NAT helper: special module reads control channel, rewrites IPs in DATA messages, opens correct port.

IPv6: typically no NAT (each device gets public IPv6). Conntrack still useful for stateful firewall.