This following article talks about Network Address Translation (NAT) and port forwarding.

What is port forwarding and what is it used for?

What is the point of port forwarding when NAT seems to do the job fine? All the router needs to know is which computer to direct the packet to, right? Let's say it directs the packet to the appropriate computer and is clueless about the port--won't the target computer know what to do with the packet, with or without the port number? And if you use port forwarding, don't you need to know the target computer anyways?

migrated from security.stackexchange.com Jul 6 '16 at 19:07

This question came from our site for information security professionals.

  • 3
    this seems like this should be asked on superuser, like your linked question ... – schroeder Jul 6 '16 at 15:21
  • 1
    How is this related to information security? – a CVn Jul 6 '16 at 15:24
  • I'd reference a page that has the answer, but it seems you've already done that. – Lutefisk Jul 6 '16 at 18:00
  • Lutefisk is obviously having a bad day. If my link had a well-formed answer, I wouldn't be posting this question in the first place, right? Clearly, the answer is either not there or not worded explicitly enough for a beginner like me. Is there anybody out there who operates at a higher level of intelligence than Lutefisk? – Boris Chernis Jul 6 '16 at 18:13

NAT does its job fine, but port forwarding has a different job. To understand this, it is important to remember the difference between incoming connections and outgoing connections.

Suppose that you and I are going to have a phone conversation. I might call you, or you might call me. In either case, we will be able to send messages (sentences) back and forth, but there is a difference in who starts the call. If I call you, it is an outgoing connection for me and an incoming connection for you. For this to be possible, I will need to know your phone number first. When you pick up the phone, you get my caller ID (which is my phone number). For the purpose of this explanation, let us pretend that you need to know my phone number in order to talk back to me.

Now imagine that our phonecalls are routed through two other phones (the routers), who are connected to many people:

You <----> Router 1 <----> Router 2 <----> Me
              ^               ^
              |               |
              v               v
             Many            Many
            Others          Others

To make matters complicated, I know only the phone number of Router 1 and not your personal number. Conversely, you know only the phone number of Router 2 and not my personal number. When I call you, we have two problems:

  1. Router 1 somehow needs to know that the call must go to you and not to one of the many others it connects to.
  2. Router 2 somehow needs to know that when you talk back, the sentence must be sent to me and not to somebody else.

Port forwarding solves problem 1. Calling about Super User is a service which is conducted through port 42 by convention. You tell Router 1 to forward all calls about Super User to you, so when I call Router 1 on port 42, I get to talk to you. If you had not explicitly told Router 1 to do this, we would not be able to call.

NAT solves problem 2. Router 2 pretends to be the caller, because neither you nor Router 1 will take up the phone if the caller ID is unknown (my phone number). It then remembers that I am the actual caller, so when Router 2 receives a response from Router 1, it knows to send it to me.

The situation on the internet is almost exactly the same. You just have to mentally replace the phones by computers, phone numbers and caller IDs by IP addresses, and unknown phone numbers by reserved IP addresses (such as the 192.168.*.* range).

  • In your analogy, the port number might be what Old People(tm) used to call an extension. To reach Super User, dial extension 42. – Yorik Jul 6 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.