How does a NAT behind a NAT work (router's NAT and ISP's NAT)?

Question

I'm using a modem-router and in certain cases am also behind an ISP NAT. How does a NAT (the router's NAT) behind a NAT (the ISP's NAT) work?

As far as I know a NAT works like this: computers A and B get internal IPs internal1 and internal2. Then the NAT gives them ports on the same IP, so that public facing they are behind someIP:1 and someIP:2.

But if the router does that and then the ISP does it again, the IPs would be of the form someIP:1:100, someIP:2:101 which is impossible because ports don't have second level ports.

So how does this work?

Answer 1

Let's try a simple example.

In a "normal" NAT'd home network, 192.168.1.2:11223 gets mapped to the "public" address:port pair 203.0.113.5:22334. So the eventual destination host thinks it received a packet from 203.0.113.5:22334 and has no knowledge of the "private" network behind it.

---

Now, let's expand that to a double-NAT network, with two levels of NAT.

On the router closest to the host, 192.168.1.2:11223 gets mapped to the "public" address:port pair 10.0.0.8:22334. Now, 10.0.0.8 is still a private address, just in a different network. As far as this router is concerned, its job is done.

On the next router, which serves as the gateway for the LAN the first router is on, 10.0.0.8:22334 is mapped to another address:port pair on its own public interface, 203.0.113.5:12345.

The eventual destination host thinks it received a packet from 203.0.113.5:12345. It, and the public internet as a whole, has no knowledge of any of the 10.0.0.0/8 or 192.168.0.0/16 subnets that were involved here. It will send a response back to that address, which must be translated back by each router in turn.

                              Different address:port pairs for
                              thesame endpoint in one connection!
+------------------------+    -----------------------------------
|Host                    |
|192.168.1.2             |
+------------------------+    192.168.1.2:11223 <--- Host sees
                                                     this pair

+------------------------+    192.168.1.2:11223 <--- Router 1 sees
|Router 1                |                           req from this
|internal 192.168.1.1/24 |
|external 10.0.0.8       |
+------------------------+    10.0.0.8:22334 <------ Router 1 sends
                                                     req from this

+------------------------+    10.0.0.8:22334 <------ Router 2 sees
|Router 2                |                           req from this
|internal 10.0.0.1/24    |
|external 203.0.113.5    |
+------------------------+    203.0.113.5:12345 <--- Router 2 sends
                                                     req from this

+------------------------+    203.0.113.5:12345 <--- Public internet
|Public internet         |                           sees this pair
+------------------------+

---

CGN ("ISP NAT") works much the same way. The only difference is that it does not give its internal hosts a RFC1918 private address, since this can clash with business networks. Instead, an address from the 100.64.0.0/10 range (RFC6598) is distributed by "Router 2" in the diagram above. As far as the customer's own router sees, its "public" address is from that range - but not actually reachable on the public internet!

Answer 2

As far as I know a NAT works like this: computers A and B get internal IPs internal1 and internal2. Then the NAT gives them ports on the same IP, so that public facing they are behind someIP:1 and someIP:2.

No. Ports are not part of the host address – there is no such thing as ports at the IP layer, whether NAT is used or not. A host's IP address is always just the address; it doesn't have "second level" ports and it doesn't have "first level" ports either.^[1]

Instead, ports belong to each individual TCP/UDP connection that the host makes on top of IP. (Well, strictly speaking they're part of each packet, and all packets in the same connection use the same ports.)

So when you see an address written as 12.34.56.78:123, the whole thing is not the host's IP address – that's a TCP connection endpoint for port 123 at a host whose IP address is still simply 12.34.56.78.

These ports are not added by NAT – they've always been there; every TCP or UDP packet has exactly two ports (one 'source' port and one 'destination' port). A router which performs NAT merely translates them to different values. No matter how many levels of NAT you have, that packet is still going to have two ports.

---

^[1] This means that when you have two hosts NATed behind a single public address, they're actually indistinguishable to the IP layer – when an IP packet from the outside is sent to someIP it has no way to specify which host it wants; the NAT router has to infer this from the TCP layer. That's why you have to configure "port forwarding" rules in order to receive inbound connections.