What is NAT (Network Address Translation)?

NAT (Network Address Translation) is a mechanism for converting IP addresses within a private network (such as a home or office network) to one or more external network (Internet) IP addresses, and vice versa.

Working principle:

1. Devices in the private network use private IP addresses (e.g., from ranges 192.168.x.x, 10.x.x.x).
2. When requesting an external resource (Internet), packets pass through a NAT device (router).
3. The NAT device replaces the private IP address and sender's port with its public IP address and a unique port.
4. The conversion information is stored in the NAT table.
5. The packet is sent to the external network with the public IP address.
6. When the response packet arrives at the NAT device's public IP, it looks into its NAT table.
7. Based on the information in the NAT table, the device determines which internal device the packet is intended for and replaces its public IP and port with the private IP and port of that device.
8. The packet is delivered to the end device in the private network.

// Example of a NAT table entry (simplified)
// Internal IP:Port -> External IP:Port NAT -> Destination External IP
// 192.168.1.10:54321 -> 203.0.113.1:60001 -> 8.8.8.8:53
// This means that the packet from 192.168.1.10:54321 was translated to 203.0.113.1:60001

Types of NAT:

• Static NAT: One private IP address is permanently mapped to one public IP address. Rarely used, mainly for servers that need to be accessible from the Internet.
• Dynamic NAT: A group of private IP addresses is dynamically mapped to a pool of public IP addresses from an available range.
• PAT (Port Address Translation) / NAPT (Network Address Port Translation) / Masquerading: The most common type. Multiple devices with private IP addresses use a single public IP address, distinguished by the port used.

Advantages:

• Saving public IP addresses: Allows multiple devices in a private network to share a single public IP address.
• Increased security: Hides the internal network structure from the outside world. Devices in the private network are by default inaccessible from the Internet.

Disadvantages:

• Restrictions for incoming connections: Direct incoming connections from the Internet to devices in the private network are difficult (port forwarding needs to be configured).
• Issues with some protocols: Some protocols that embed IP addresses in packet data may not work correctly with NAT.
• Difficulties in diagnostics: Harder to trace which internal device generated specific traffic.