Let's try a simple example.
In a "normal" NAT'd home network, 192.168.1.2:11223
gets mapped to the "public" address:port pair 203.0.113.5:22334
. So the eventual destination host thinks it received a packet from 203.0.113.5:22334
and has no knowledge of the "private" network behind it.
Now, let's expand that to a double-NAT network, with two levels of NAT.
On the router closest to the host, 192.168.1.2:11223
gets mapped to the "public" address:port pair 10.0.0.8:22334
. Now, 10.0.0.8
is still a private address, just in a different network. As far as this router is concerned, its job is done.
On the next router, which serves as the gateway for the LAN the first router is on, 10.0.0.8:22334
is mapped to another address:port pair on its own public interface, 203.0.113.5:12345
.
The eventual destination host thinks it received a packet from 203.0.113.5:12345
. It, and the public internet as a whole, has no knowledge of any of the 10.0.0.0/8
or 192.168.0.0/16
subnets that were involved here. It will send a response back to that address, which must be translated back by each router in turn.
Different address:port pairs for
thesame endpoint in one connection!
+------------------------+ -----------------------------------
|Host |
|192.168.1.2 |
+------------------------+ 192.168.1.2:11223 <--- Host sees
this pair
+------------------------+ 192.168.1.2:11223 <--- Router 1 sees
|Router 1 | req from this
|internal 192.168.1.1/24 |
|external 10.0.0.8 |
+------------------------+ 10.0.0.8:22334 <------ Router 1 sends
req from this
+------------------------+ 10.0.0.8:22334 <------ Router 2 sees
|Router 2 | req from this
|internal 10.0.0.1/24 |
|external 203.0.113.5 |
+------------------------+ 203.0.113.5:12345 <--- Router 2 sends
req from this
+------------------------+ 203.0.113.5:12345 <--- Public internet
|Public internet | sees this pair
+------------------------+
CGN ("ISP NAT") works much the same way. The only difference is that it does not give its internal hosts a RFC1918 private address, since this can clash with business networks. Instead, an address from the 100.64.0.0/10
range (RFC6598) is distributed by "Router 2" in the diagram above. As far as the customer's own router sees, its "public" address is from that range - but not actually reachable on the public internet!