I am trying to understand how NAT and NAT tables work but cant seem to find answers online. I have a few questions regarding NAT. Assume TCP connection made.

Assume router has WAN

1) Lets say a device with IP wants to connect to a server with IP The device first encapsulates the data in a IP datagram with source IP as and dest IP as ?

2) After which the datagram is sent to the router where NAT happens. Assuming this is the first packet being sent in the private network, the NAT table is initially empty ?

3) Now there is a entry in the table which maps to ? ->

The IP datagram is repackaged with the corresponding router address ( and port number 2345 before being sent out. Is there a separate TCP connection from the router to the server ? Or is the entry just a virtual port number assigned ?

4) The data comes back from the server with dst IP and dest port 2345. The router does a table look up and finds that is mapped to So it repackages the IP datagram with src address and dst address

I am not sure if the steps I highlighted are correct.

  • 3
    You've described this pretty much as it happens. If you're confused about whether or not there's a separate TCP connection, the answer is no, all the SYN & ACK packets governing TCP are forwarded to the original connection source in the exact same way you've described. – Radhil Nov 20 '18 at 16:09

I will try to be simple in the explanation. You have mainly two types of NAT:

  • Source NAT: Typically known as 'masquerade', it masks your local IP address with his address so that it can communicate with hosts in networks that do not know the route to your local network.
  • Destination NAT: Usually known as 'port forwarding' it translates the destination network address to a local address in a foreign network.

I think what you are describing is a source NAT, your communication from your local network to a server in the internet. And what happens is as you said, but let me rephrase a little bit:

  1. You generate a connection from your local net to internet: ->, your source port is random.
  2. Based on your routing table, in the local host with the IP, your packet will go to the next hop, usually your default gateway for internet destinations.
  3. when your packet arrives to a device that has a configured Source NAT, it will translate the source address, masquerading the source of the packet and converting it into -> And it will remember that this connection is from your local IP
  4. Let's suppose that, as most of the times, is a firewall that will NAT the destination port PORT to a foreign local network, for instance, and let's suppose it is a web server, so it will translate the packet as ->
  5. The server at will receive then a request from, and when returning, the same thing will happen on the other way, based on his routing table, he will go back to
  6. The router/firewall will need to masquerade on the other way, changing the packet addresses as ->
  7. Your router at will receive the packet, will be able to detect that is related to the stream generated by and will return the response. will see a packet that comes from, as has been masqueraded.

Hope it helps and it does not generate more confusion.

Side note

TCP connections are not organized in datagrams, they are streams. Datagrams are UDP.

| improve this answer | |
  • 1
    For the sake of clarity you may want to change the the word translate to rewrite. (Strictly speaking there is no transaction occurring, packets are being rewritten based on tracking in a lookup table). Your answer is, of course, otherwise correct. – davidgo Nov 20 '18 at 18:18
  • 1
    Hi @davidgo thanks for your comment, and let me respectfully disagree. It is actually a translation (not a transaction as you well said, but I didn’t say transaction), moreover, ‘translation’ is the T in NAT. I would say that rewrite is just another way of saying it – Jorge Valentini Nov 20 '18 at 18:45
  • Hi @JorgeValentini from step 2 to step 3 when you say that your packet arrives to a device that has configured Source NAT, is that the default gateway router you are talking about ? So there could be multiple NAT's when your home device wants to connect with a server in the internet because i thought there was only one NAT translation for your home network ? Are those devices that configure Source NAT routers ? – calveeen Nov 21 '18 at 0:52
  • Hi @calveen, usually in a home environment the NAT is performed by your ISP router/modem, while strictly speaking a NAT is an instance of firewall, usually these home devices do everything and are the default gateway for the network also, so it’s blurry. Answering to your question, there may be one or more NATs in a more complex network, a typical example of a double NAT could be a DMZ, but I think you go to a much simpler environment, right? As it was not clear to me how simple/complex it was, I didn’t want to specify which one is the device doing the NAT – Jorge Valentini Nov 21 '18 at 1:09

The following is for the Linux kernel, but I'd assume MacOS and Windows work similar.

What you call the "NAT table" is called the connection tracker or conntrack for short. There are tools that you can use to inspect this table.

1) Yes.

2) Yes. To be precise, the connection tracking table doesn't have an entry for this connection, it needn't be empty. A connection is characterized by source address, source port, destination address, and destination port; the port number it is nat'ed to is an additional entry.

3a) Yes, where 2345 is a port that is not already in use. IIRC it defaults to the original source port. The connection tracker entry is made because there's an iptables rule with SNAT (source NAT) target.

b) No, this connection is not tracked as a normal TCP connection. The netfilter connection tracker and the TCP connection state table are completely different.

4) Yes. Note that there need not be a reverse iptables rule; this confuses many people.

| improve this answer | |
  • 1
    Please consider quoting the OP's queries in your post as you answer them to make it easier to comprehend. (It's not mandatory, just nicer.) – I say Reinstate Monica Nov 20 '18 at 18:15
  • "There are tools that you can use to inspect this table". Do these tools exist for most consumer routers, or are you talking about something specific to Linux netfilter? – Barmar Nov 23 '18 at 19:53
  • @Barmar: Well, both: The tools are specific to Linux netfilter, but the vast majority of consumer routers are embedded Linux machines, so you can cross compile the tools/modules, or install firmware that already has them. – dirkt Nov 24 '18 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.