NAT and PAT

Why NAT exists

IPv4 has about 4.3 billion addresses, far fewer than the devices in the world. The private ranges (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) can be used freely inside any organisation, but they are not routed on the internet. NAT, done by the router at the edge, replaces the private source address of outgoing packets with a public one, and reverses the change for the replies. One public address can then serve a whole office.

The four terms

Cisco describes every address in a translation by two words: inside or outside (whose address is it?) and local or global (from which side is it seen?).

Three kinds of NAT

• Static NAT: one private address is permanently mapped to one public address. Used for servers that people outside must reach, such as a web or mail server.
• Dynamic NAT: inside hosts get a public address from a pool, first come first served, one public address per host while it is in use. If the pool runs out, new hosts cannot get out. Rare today.
• PAT (Port Address Translation), also called NAT overload: many inside hosts share ONE public address. The router tells conversations apart by the source port number. This is what every home router and most offices use.

How PAT keeps conversations apart

Every TCP or UDP conversation has a source port. When two laptops both use source port 51000, the router keeps one as 203.0.113.2:51000 and changes the other to, say, 203.0.113.2:1024. Each entry in the NAT table maps (inside address, inside port) to (public address, public port). When a reply arrives for 203.0.113.2:1024, the router looks it up and sends it to the second laptop. One public address has about 65,000 ports per protocol, so in theory tens of thousands of conversations can share it. An office of 200 people with browsers, email and Teams fits easily.

Configuring NAT on a Cisco router

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 203.0.113.2 255.255.255.248
R1(config-if)# ip nat outside

! PAT: every host in 192.168.10.0/24 shares G0/1's address
R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

! Static NAT: the web server is always 203.0.113.5 on the internet
R1(config)# ip nat inside source static 192.168.10.50 203.0.113.5

For dynamic NAT with a pool, you define the public range and point the rule at it: ip nat pool PUBLIC 203.0.113.3 203.0.113.4 netmask 255.255.255.248, then ip nat inside source list 1 pool PUBLIC. Adding overload to that line turns it into PAT over the pool.

Verifying

R1# show ip nat translations
Pro  Inside global       Inside local          Outside local       Outside global
tcp  203.0.113.2:51000   192.168.10.21:51000   198.51.100.7:443    198.51.100.7:443
tcp  203.0.113.2:1024    192.168.10.22:51000   198.51.100.7:443    198.51.100.7:443
---  203.0.113.5         192.168.10.50         ---                 ---

R1# show ip nat statistics
R1# clear ip nat translation *

CGNAT: NAT at the ISP

Many mobile operators and some broadband ISPs, in India and elsewhere, do not have enough public IPv4 addresses for every customer. They use carrier-grade NAT (CGNAT): your router or phone gets an address from 100.64.0.0/10 (a range reserved for this) or another private range, and the ISP translates again to a shared public address. The effect is double NAT: browsing works, but nobody on the internet can start a connection to you, so port forwarding for a home camera or game server will not work. IPv6 removes the need for NAT because there are enough addresses for every device.