NAT (Network Address Translation)

NAT (Network Address Translation) is the technology that allows multiple devices on a private network to share a single public IP address to access the internet. It's one of the most important networking concepts—without it, we would have run out of IPv4 addresses decades ago. For cybersecurity professionals, understanding NAT is crucial for network reconnaissance, firewall evasion, port forwarding, and understanding how traffic flows between networks.

What You'll Learn

What NAT is and why it exists
How NAT works (address translation process)
Types of NAT (Static, Dynamic, PAT/NAT Overload)
Port forwarding and port triggering
NAT traversal techniques
Security implications of NAT
NAT in penetration testing
Tools and techniques for working with NAT

The IPv4 Address Exhaustion Problem

The Problem:

IPv4 addresses available: ~4.3 billion
World population: ~8 billion
Devices per person: Multiple (phone, laptop, tablet, IoT, etc.)

Math doesn't work! 📉

The Solution: NAT

Allow multiple devices to share one public IP:

Home Network (Private IPs):          Public Internet:
─────────────────────────           ────────────────
Laptop:    192.168.1.100    ┐
Phone:     192.168.1.101    ├─ Router (NAT) ─→ 203.0.113.5
Smart TV:  192.168.1.102    ┘        ↑
IoT:       192.168.1.103            Public IP

All devices share 203.0.113.5 to access internet

What Is NAT?

NAT translates private IP addresses to public IP addresses (and vice versa).

Key Functions:

Outbound: Translate private → public
Inbound: Translate public → private
Track connections: Remember which internal device made which request
Port mapping: Use port numbers to distinguish connections

How NAT Works

Outbound Connection (Internal → Internet):

Step 1: Internal device sends packet
────────────────────────────────────
Source:      192.168.1.100:45678
Destination: 8.8.8.8:53 (Google DNS)

Step 2: Router (NAT) translates source address
───────────────────────────────────────────────
Source:      203.0.113.5:45678    ← Public IP, same port
Destination: 8.8.8.8:53

Step 3: Response from internet
───────────────────────────────
Source:      8.8.8.8:53
Destination: 203.0.113.5:45678

Step 4: Router translates destination back
──────────────────────────────────────────
Source:      8.8.8.8:53
Destination: 192.168.1.100:45678  ← Back to private IP

NAT Translation Table:

Router maintains a table:

Internal IP:Port       Public IP:Port       Destination
─────────────────────  ───────────────────  ──────────────
192.168.1.100:45678 ←→ 203.0.113.5:45678 → 8.8.8.8:53
192.168.1.101:55123 ←→ 203.0.113.5:55123 → 1.1.1.1:53
192.168.1.102:33456 ←→ 203.0.113.5:33456 → 142.250.185.46:80

Types of NAT

1. Static NAT (One-to-One)

Maps one private IP to one public IP permanently.

Private IP        Public IP
──────────────    ──────────────
192.168.1.10  ←→  203.0.113.10
192.168.1.11  ←→  203.0.113.11
192.168.1.12  ←→  203.0.113.12

Use case:

Web servers
Mail servers
Any service that needs to be accessible from internet

Example:

You have web server at 192.168.1.10
Configure static NAT: 203.0.113.10 → 192.168.1.10
Anyone accessing 203.0.113.10 reaches your web server

Pros: Simple, consistent Cons: Wastes public IPs (need one per device)

2. Dynamic NAT (Pool-based)

Maps private IPs to public IPs from a pool, dynamically.

Private IPs:          Public IP Pool:
───────────          ────────────────
192.168.1.100  ─┐    203.0.113.10
192.168.1.101  ─┼→   203.0.113.11
192.168.1.102  ─┤    203.0.113.12
192.168.1.103  ─┘    203.0.113.13

How it works:

Device requests internet access
Router assigns available public IP from pool
Mapping released when connection ends
Next device can use that public IP

Use case: Organizations with more devices than public IPs, but not all online simultaneously

Pros: More efficient than static NAT Cons: Still need multiple public IPs, possible conflicts

3. PAT (Port Address Translation) / NAT Overload

Maps many private IPs to ONE public IP using different ports.

All devices:                Router (PAT):           Internet:
────────────                ─────────────           ─────────
192.168.1.100:45678  ─┐
192.168.1.101:55123  ─┼→  203.0.113.5:XXXXX  →  8.8.8.8
192.168.1.102:33456  ─┤                           1.1.1.1
192.168.1.103:12345  ─┘                           172.217.1.1
         ↑                       ↑
    Internal port          Translated port

Translation table:

Inside (Private)        Outside (Public)         Destination
────────────────────    ────────────────────     ─────────────
192.168.1.100:45678 ←→  203.0.113.5:1025     →  8.8.8.8:53
192.168.1.101:55123 ←→  203.0.113.5:1026     →  1.1.1.1:443
192.168.1.102:33456 ←→  203.0.113.5:1027     →  142.250.185.46:80

This is what your home router uses!

Pros:

Thousands of devices share one public IP
Solves IPv4 exhaustion
Most common NAT type

Cons:

Inbound connections difficult (need port forwarding)
Can break some applications (P2P, VoIP)

Port Forwarding

Problem: NAT blocks incoming connections to private IPs.

Solution: Port forwarding (static port mapping).

How It Works:

Internet                Router (Port Forwarding)         Internal Network
────────                ────────────────────────         ────────────────
Anyone accessing        Port 80 → 192.168.1.10:80       Web Server
203.0.113.5:80  ───→    Port 22 → 192.168.1.11:22       SSH Server
203.0.113.5:22  ───→    Port 3389 → 192.168.1.12:3389   RDP Server
203.0.113.5:3389 ───→

Configuration Example:

Router settings:

External Port    Internal IP        Internal Port    Protocol
─────────────    ───────────────    ─────────────    ────────
80           →   192.168.1.10       80               TCP
443          →   192.168.1.10       443              TCP
22           →   192.168.1.11       22               TCP
3389         →   192.168.1.12       3389             TCP

Common Use Cases:

Gaming:         Forward game ports to console/PC
Web Server:     Forward 80/443 to web server
Remote Access:  Forward 22 (SSH) or 3389 (RDP)
Security Cams:  Forward camera ports
Torrenting:     Forward BitTorrent ports

Security Implications:

⚠️ Risks:

Exposes internal services to internet
If service vulnerable, attacker gets internal access
Common pentesting target

Best practices:

Only forward necessary ports
Use strong authentication
Keep services updated
Consider VPN instead

Port Triggering

Dynamic port forwarding based on outbound traffic.

How It Works:

1. Internal device initiates connection on trigger port
2. Router opens specific ports temporarily
3. External device can connect through opened ports
4. Ports close after timeout

Example:

Gaming console connects to game server (trigger)
Router opens ports 3074-3079 for incoming game traffic
Game works properly
Ports close after game session ends

Difference from port forwarding:

Port forwarding: Always open
Port triggering: Opens only when needed

NAT Traversal Techniques

Problem: Applications need to work through NAT.

1. STUN (Session Traversal Utilities for NAT)

Client → STUN Server: "What's my public IP:port?"
STUN Server → Client: "Your public IP is 203.0.113.5:45678"
Client uses this info to communicate with peers

Use case: VoIP, video calls, WebRTC

2. TURN (Traversal Using Relays around NAT)

If STUN fails, use relay server:
Client A → TURN Server → Client B

Use case: When direct connection impossible

3. UPnP (Universal Plug and Play)

Application → Router: "Please forward port 12345 to me"
Router: "OK, port forwarded"

⚠️ Security risk: Applications can open ports without user knowledge

Disable UPnP unless absolutely needed:

Router settings → UPnP → Disable

4. ICE (Interactive Connectivity Establishment)

Combination of STUN, TURN, and direct connection attempts
Used by: WebRTC, modern VoIP

NAT and Security

Security Benefits:

1. Hides Internal Network:

External attacker sees:     203.0.113.5
Internal network:           192.168.1.0/24 (hidden)

2. Implicit Firewall:

Inbound connections blocked by default
Must explicitly configure port forwarding

3. Limits Attack Surface:

Can't directly access internal devices
Must go through router/firewall

Security Drawbacks:

1. False Sense of Security:

NAT ≠ Firewall
NAT doesn't inspect packets
Doesn't block outbound malicious traffic

2. Complicates Logging:

All internal devices use same public IP
Harder to identify which device did what

3. Breaking Encryption:

Some NAT implementations inspect/modify packets
Can break end-to-end encryption

4. UPnP Vulnerabilities:

Malware can open ports through UPnP
Exposing internal services

NAT in Penetration Testing

Reconnaissance:

Identify NAT:

# Your public IP
curl ifconfig.me

# Your private IP
ip addr show  # Linux
ipconfig      # Windows

# If different: You're behind NAT

Detect NAT from outside:

# Look for multiple TTL values from same IP
# Indicates multiple devices behind NAT

# Check for incrementing IP IDs
hping3 -S -p 80 -c 5 target.com
# Varying IP IDs suggest NAT

Exploitation:

1. Target Port-Forwarded Services:

# Scan for common forwarded ports
nmap -p 22,80,443,3389,8080 target-ip

# These often lead directly to internal devices

2. Exploit UPnP:

# Scan for UPnP
nmap -sU -p 1900 --script upnp-info target-ip

# If UPnP enabled, may be able to add port forwards
# Tools: miranda, upnp-arsenal

3. NAT Pinning:

Keep NAT port open by sending keepalive packets
Maintain persistent connection

4. DNS Rebinding:

Bypass NAT/firewall by exploiting DNS
Change DNS resolution mid-session
Access internal resources

Post-Exploitation:

Once inside NAT:

# Enumerate internal network
arp -a
ip neigh show

# Scan internal subnet
nmap -sn 192.168.1.0/24

# Pivot to other internal devices
# Use compromised host as proxy
ssh -D 9050 user@compromised-host
proxychains nmap 192.168.1.0/24

Checking Your NAT Configuration

Find Your Public IP:

# Command line
curl ifconfig.me
curl icanhazip.com
curl ipinfo.io/ip

# DNS method
dig +short myip.opendns.com @resolver1.opendns.com

Find Your Private IP:

# Linux
ip addr show
hostname -I

# Windows
ipconfig

# macOS
ifconfig

Check NAT Type (Gaming):

Strict NAT: Can only connect to Open NAT Moderate NAT: Can connect to Open and Moderate Open NAT: Can connect to all types (best for gaming)

# Test NAT type
# Varies by game console/application
# Generally: Open > Moderate > Strict

Configuring NAT (iptables Example)

Enable NAT/Masquerading:

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Make permanent
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

# Configure NAT (masquerade)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# eth0 = internet-facing interface
# Translates all outbound traffic from internal network

Port Forwarding (iptables):

# Forward port 80 to internal web server
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80

# Forward port 22 to internal SSH server
iptables -t nat -A PREROUTING -p tcp --dport 22 -j DNAT --to-destination 192.168.1.11:22

# Allow forwarding
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.11 --dport 22 -j ACCEPT

View NAT Table:

# Show NAT rules
iptables -t nat -L -n -v

# Show connection tracking
cat /proc/net/nf_conntrack

NAT64 and IPv6 Transition

NAT64: Translates between IPv6 and IPv4.

IPv6-only device ←→ NAT64 ←→ IPv4 internet

Purpose: Allow IPv6-only devices to access IPv4 resources during transition.

Double NAT (The Nightmare)

Double NAT: NAT behind NAT.

Device (192.168.1.100)
    ↓
Router 1 (NAT) → 10.0.0.5
    ↓
Router 2 (NAT) → 203.0.113.5 (Public)
    ↓
Internet

Problems:

Port forwarding complicated
Gaming/VoIP issues
VPN connections fail
Slower performance

Detection:

traceroute 8.8.8.8

# If you see multiple private IP ranges:
# 192.168.x.x → 10.x.x.x → Public IP
# You have double NAT

Solution:

Put one router in bridge/passthrough mode
Disable NAT on inner router

Try It Yourself

Exercise 1: Identify Your NAT Setup

# Find your public IP
curl ifconfig.me

# Find your private IP
# Linux:
ip addr show | grep inet
# Windows:
ipconfig | findstr IPv4

# Are they different? You're behind NAT.

Exercise 2: View NAT Connections

# Linux (if you have router access)
cat /proc/net/nf_conntrack

# Windows (on your PC)
netstat -an

# Identify:
# - Your private IP connections
# - Where they're going
# - Port numbers used

Exercise 3: Test Port Forwarding

# Set up simple web server
python3 -m http.server 8080

# Configure port forwarding on router:
# External: 8080 → Internal: 192.168.1.x:8080

# Test from outside network
curl http://[your-public-ip]:8080

# Did it work?

Exercise 4: Scan NAT'd Network

# From inside network, scan your subnet
nmap -sn 192.168.1.0/24

# How many devices found?
# All share the same public IP!

NAT Quick Reference

# Find public IP
curl ifconfig.me

# Find private IP
ip addr show          # Linux
ipconfig              # Windows

# Check NAT table (router)
iptables -t nat -L    # Linux router

# Enable NAT (router)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Port forward (router)
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80

# Test external access
curl http://[public-ip]:[port]

Resources

Documentation:

RFC 1631: NAT specification
RFC 3022: Traditional NAT
RFC 5128: State of NAT

Tools:

iptables: Linux NAT configuration
tcpdump/Wireshark: Analyze NAT traffic
nmap: Scan through NAT
miranda: UPnP exploitation

Reading:

Next Steps

Configure NAT on a router/firewall (lab environment)
Set up port forwarding for a service
Understand NAT types for gaming/VoIP
Learn NAT traversal techniques (STUN, TURN)
Study NAT in pentesting scenarios

NAT is everywhere—your home router uses it, corporate networks use it, cloud providers use it. Understanding NAT is essential for networking, security, and penetration testing!

"NAT: The reason the internet didn't run out of addresses in 1995."