NAT and PAT: Deep Dive into Address Translation

Introduction

NAT (Network Address Translation) and PAT (Port Address Translation) are technologies that allow private IP addresses to communicate on the internet. While every junior network engineer knows what NAT does conceptually, truly mastering it means understanding the different types, their behaviors with specific applications, troubleshooting translation table issues, and configuring NAT in complex enterprise scenarios. This guide dives deep.

NAT Types Explained

Static NAT: One-to-one permanent mapping:

TEXT

Private: 192.168.1.50 ←→ Public: 203.0.113.50 (always)
Use case: DMZ servers that must be consistently reachable from internet

Dynamic NAT: Pool of public IPs assigned on demand:

TEXT

Private 192.168.1.0/24 → Pool: 203.0.113.100-203.0.113.110 (first-fit)
Use case: When you have multiple public IPs but fewer than clients

PAT (Overload/Many-to-One NAT): Multiple private IPs → single public IP:

TEXT

192.168.1.10:54321 → 203.0.113.1:10001 (tracked by port)
192.168.1.11:54322 → 203.0.113.1:10002
192.168.1.12:65001 → 203.0.113.1:10003
Use case: 99% of home/office internet connections

Cisco IOS NAT Configuration

TEXT

! PAT (most common): Many inside → One outside address
interface GigabitEthernet0/0
  ip address 192.168.1.1 255.255.255.0
  ip nat inside

interface GigabitEthernet0/1
  ip address 203.0.113.1 255.255.255.252
  ip nat outside

! Define what to translate
ip access-list standard INSIDE-HOSTS
  permit 192.168.1.0 0.0.0.255

! Enable PAT using outside interface IP
ip nat inside source list INSIDE-HOSTS interface GigabitEthernet0/1 overload

! Verify
show ip nat translations
show ip nat statistics

TEXT

! Static NAT: DMZ web server
ip nat inside source static 192.168.100.10 203.0.113.50

! Static NAT with port (Port Forwarding):
! External port 8443 → internal server port 443
ip nat inside source static tcp 192.168.100.20 443 203.0.113.1 8443

! Dynamic NAT pool
ip nat pool PUBLIC-POOL 203.0.113.100 203.0.113.110 netmask 255.255.255.240
ip nat inside source list INSIDE-HOSTS pool PUBLIC-POOL

Linux NAT with iptables

BASH

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

# PAT: masquerade all traffic from 192.168.1.0/24 through eth0
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

# Static DNAT (port forwarding):
# External :80 → 192.168.1.50:80
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80   -j DNAT --to-destination 192.168.1.50:80

# Allow forwarding
iptables -A FORWARD -d 192.168.1.50 -p tcp --dport 80 -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4

# With nftables (modern alternative):
nft add rule ip nat POSTROUTING oifname "eth0" masquerade
nft add rule ip nat PREROUTING iifname "eth0" tcp dport 80 dnat to 192.168.1.50

Double NAT (Nested NAT)

TEXT

Problem scenario:
Internet → ISP Router (NAT: 100.64.x.x → public) →
  Customer Router (NAT: 192.168.1.x → 100.64.x.x) →
  Device

This is "Double NAT" (common with CG-NAT ISPs).
Issues it causes:
- Port forwarding doesn't work (two layers to configure)
- Some applications break (gaming, VoIP, video calls)
- Troubleshooting becomes complex

Solutions:
1. Ask ISP for public IP (bypass CG-NAT)
2. Use VPN to ISP to get routable address
3. Use UPNP on outer router (often not available)
4. For servers: use IPv6 (no NAT needed)

NAT and Application Layer Gateways (ALG)

Some protocols embed IP addresses in their payload (FTP, SIP, H.323), breaking NAT:

TEXT

FTP problem: FTP client sends its private IP in PORT command:
"PORT 192.168.1.50,x,y" → Server tries to connect to 192.168.1.50 (unreachable!)

Solution: FTP ALG (Application Layer Gateway) rewrites the payload:
"PORT 192.168.1.50,x,y" → "PORT 203.0.113.1,x,y"

# Cisco IOS: ALG is often enabled by default
# Check:
show ip nat translations protocol tcp

# Disable ALG if causing issues with SIP over NAT
no ip nat service sip udp port 5060

Troubleshooting NAT

TEXT

! Cisco IOS troubleshooting
! See current translation table
show ip nat translations
show ip nat translations verbose

! Statistics (track hits, misses, expired)
show ip nat statistics

! Debug NAT translations (be careful in production!)
debug ip nat
debug ip nat [access-list SPECIFIC-HOST]

! Common issues:
! 1. "No translation" - ACL or route miss
!    Check: show ip route 203.0.113.x (is return traffic routed back?)
! 2. Asymmetric routing (traffic goes in one router, returns via different)
!    Fix: ensure both directions pass through same NAT device
! 3. NAT table full (too many concurrent sessions)
!    Check: show ip nat statistics | include max
!    Fix: ip nat translation max-entries 100000

BASH

# Linux NAT troubleshooting
# View current NAT table
conntrack -L

# Watch real-time translations
conntrack -E

# Count entries
conntrack -C

# Clear stale connections
conntrack -D --state TIME_WAIT

NAT64 (IPv6 to IPv4 Translation)

TEXT

As IPv6 adoption grows, some clients are IPv6-only and need to reach IPv4 servers.
NAT64 translates between them:

IPv6 client: 2001:db8::1
NAT64 prefix: 64:ff9b::/96
IPv4 server: 203.0.113.50

IPv6 client sends to: 64:ff9b::203.0.113.50 (embedded IPv4)
NAT64 router translates to: 203.0.113.50
Return traffic translated back

# Configure NAT64 on Cisco
ipv6 nat v6v4 source 2001:db8::/32 203.0.113.0
ipv6 nat prefix 64:ff9b::/96 v4-mapped

NAT mastery requires understanding not just configuration syntax but the behavioral implications: how it interacts with stateful firewalls, the importance of connection tracking tables, and why certain applications require ALGs or NAT traversal techniques.