Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever I host a server, I'm required to forward the listening ports of the server on my NAT device.

However, if I connect to a remote server, I won't be required to forward the port used for incoming data from the remote server.

Why is that so?

share|improve this question

migrated from Apr 2 '11 at 21:30

This question came from our site for professional and enthusiast programmers.

Not a programming question. – John Zwinck Apr 2 '11 at 17:09
You're right, my question belongs to Super User. – asmo Apr 2 '11 at 19:40
up vote 1 down vote accepted

When you make a connection outbound, the target address can be seen in the packet, the source address of your internal host is in the packet, so the NAT box "just" replaces the source address with its own, and sets up an entry in an internal table, so that for packets matching "this connection's characteristics" it knows to replace the destination address with the original source address, so the packets make it back to you.

For a server, the packet comes into the NAT from the outside and there's nothing to say which internal host it's meant for. There's no current table of connections. So instead, you need to define a rule saying "new connection requests for port 22 should be passed to this box over here".

On top of this, software running on your computers can choose to talk to any local NAT boxes with either NAT-PMP (Apple) or UPnP (Microsoft's protocol) to set up these associations automatically. But that only really helps when you don't care about which externally-facing port number you get.

share|improve this answer
Your explanation is as clear and complete as it could be! Thank you very much! – asmo Apr 3 '11 at 1:29

The outgoing connection is assumed to be what you intend and want, so it allows the connection by default. The reverse is not true; you wouldn't want any rouge internet client to connect to any server on your computer, so you have to explicitly open this up. Otherwise it'd be the same as just putting your server right on the internet with no firewall.

share|improve this answer
But, for example, whenever I play an online game, the game receive connections from the internet, even though no port forwarding is required for these incoming connections. – asmo Apr 2 '11 at 17:20
It doesn't just randomly receive connections. You initiate first contact with those servers, so the NAT knows to accept return connections back. – Andy Apr 2 '11 at 19:32

NAT Blocks incoming connections, and lets outgoing connections out. Once the connection is made, then packets can go either way.

If you set up a server, you have to deal with NAT at your end if you use NAT. If you connect to a server, they have to deal with NAT at their end, if they use NAT.

If NAT blocked outgoing connections, you wouldn't be able to access the Internet.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .