Whenever I host a server, I'm required to forward the listening ports of the server on my NAT device.
However, if I connect to a remote server, I won't be required to forward the port used for incoming data from the remote server.
Why is that so?
Whenever I host a server, I'm required to forward the listening ports of the server on my NAT device.
However, if I connect to a remote server, I won't be required to forward the port used for incoming data from the remote server.
Why is that so?
When you make a connection outbound, the target address can be seen in the packet, the source address of your internal host is in the packet, so the NAT box "just" replaces the source address with its own, and sets up an entry in an internal table, so that for packets matching "this connection's characteristics" it knows to replace the destination address with the original source address, so the packets make it back to you.
For a server, the packet comes into the NAT from the outside and there's nothing to say which internal host it's meant for. There's no current table of connections. So instead, you need to define a rule saying "new connection requests for port 22 should be passed to this box over here".
On top of this, software running on your computers can choose to talk to any local NAT boxes with either NAT-PMP (Apple) or UPnP (Microsoft's protocol) to set up these associations automatically. But that only really helps when you don't care about which externally-facing port number you get.
The outgoing connection is assumed to be what you intend and want, so it allows the connection by default. The reverse is not true; you wouldn't want any rouge internet client to connect to any server on your computer, so you have to explicitly open this up. Otherwise it'd be the same as just putting your server right on the internet with no firewall.
NAT blocks incoming connections, and lets outgoing connections out. Once the connection is made, then packets can go either way.
If you set up a server, you have to deal with NAT at your end if you use NAT. If you connect to a server, they have to deal with NAT at their end, if they use NAT.
If NAT blocked outgoing connections(it doesn't, but supposing it did), then you wouldn't be able to access the Internet.