NAT & PAT

SNAT vs DNAT, connection tracking, port forwarding, NAT traversal techniques, and why NAT breaks peer-to-peer connectivity.

Overview

Overview Network Address Translation (NAT) is the mechanism by which IP addresses are rewritten in packet headers as they traverse a router or firewall. NAT was originally designed as a stopgap to address IPv4 exhaustion — by hiding many private RFC 1918 addresses behind a single public IP, NAT allowed billions of devices to share a relatively small pool of public addresses. Today NAT is ubiquitous: home routers, cloud NAT gateways, container runtimes, and Kubernetes kube-proxy all rely on it.

Source NAT (SNAT) rewrites the source IP address of outgoing packets. This is the standard form of NAT used in home routers and cloud NAT gateways: a device with a private IP (10.0.0.5) sends a packet; the router rewrites the source to its public IP (203.0.113.1) and records the mapping in a connection tracking table. When the response arrives, the router looks up the connection and rewrites the destination back to 10.0.0.5.

PAT (Port Address Translation), also called NAPT or IP masquerade, is the most common form of SNAT. It maps multiple private (IP, port) pairs to a single public IP using different ports. This allows thousands of connections to share one public IP. The connection tracking table maps (private_ip, private_port, protocol) to (public_ip, public_port, protocol).

Destination NAT (DNAT) rewrites the destination IP (and optionally port) of incoming packets. DNAT is used for port forwarding: an external request to public_ip:80 is rewritten to private_ip:8080 and forwarded to an internal server. This is how Docker port publishing, Kubernetes NodePort and LoadBalancer services, and AWS Network Load Balancers work.

NAT fundamentally breaks the internet's end-to-end connectivity model. Two peers behind separate NATs cannot establish a direct connection by simply dialing each other's IP, because neither has a stable, reachable public endpoint. NAT traversal techniques — STUN, TURN, ICE, hole punching — are required to establish peer-to-peer connections in the presence of NAT. This complexity is a major driver of VPN adoption, WebRTC infrastructure costs, and the push toward IPv6.

Key concepts

Connection Tracking (conntrack): The kernel module that maintains a table of active network connections to enable stateful packet inspection and NAT. Each entry records the tuple (src_ip, src_port, dst_ip, dst_port, protocol), the connection state (NEW, ESTABLISHED, RELATED, INVALID), and the NAT translation to apply. conntrack entries expire after timeouts (TCP ESTABLISHED: 5 days, TIME_WAIT: 120s, UDP: 30s). Conntrack table exhaustion causes new connections to be dropped and is a common production incident on high-connection-rate systems.
SNAT (Source NAT): Rewrites the source IP address of outgoing packets. Used in NAT gateways (cloud and home routers) to allow private IP hosts to communicate with the internet. The router records the original (src_ip, src_port) to (nat_ip, nat_port) mapping and applies the reverse translation to incoming response packets. MASQUERADE is a dynamic form of SNAT that uses the outgoing interface's current IP, useful for connections where the public IP changes.
DNAT (Destination NAT): Rewrites the destination IP address (and optionally port) of incoming packets. Used for port forwarding, load balancers (which rewrite the VIP to a backend IP), and Kubernetes Services. The connection tracking table enables the router to apply the reverse translation to response packets so they return through the same NAT path. iptables PREROUTING chain applies DNAT before routing decisions.
NAT Traversal and Hole Punching: Techniques to establish direct peer-to-peer connections between hosts behind NAT. STUN (RFC 8489) allows a host to discover its public (IP, port) by querying a STUN server. UDP hole punching involves both peers sending packets to each other's STUN-discovered endpoints simultaneously; NAT routers create conntrack entries for each outgoing packet, so when the peer's packet arrives, it matches an existing entry and is forwarded. TURN (RFC 8656) is a relay fallback when direct connection fails.
Hairpin NAT (NAT Reflection): A configuration that allows hosts on the internal network to reach internal services by their public (external) IP address. Without hairpin NAT, a packet from an internal host to the router's public IP destined for an internal service may be dropped or returned incorrectly. With hairpin NAT, the router applies DNAT to rewrite the destination to the internal server's IP and SNAT to rewrite the source. Required for split-horizon DNS to work correctly.

When to use it

Designing container networking with port publishing and understanding how Docker iptables rules work
Configuring AWS NAT Gateway for private subnet internet access vs VPC peering
Debugging why a Kubernetes LoadBalancer service source IP is showing the node IP instead of the client IP
Understanding how STUN/TURN servers enable WebRTC peer-to-peer media connections through NAT
Explaining to an interviewer why NAT is a problem for peer-to-peer applications and IPv6 adoption

Interview questions

Explain how Docker port publishing works under the hood using DNAT and iptables.
Why does NAT break peer-to-peer connectivity, and how do STUN and TURN solve this for WebRTC?

NAT & PAT

Overview

Key concepts

When to use it

Interview questions

More Networking topics