NAT, explained
Network address translation, or NAT, lets many private devices reach the internet through one public address. Here is what it does to a packet, how replies find their way back, and what it does and does not protect, with links to the RFC and the AWS documentation itself.
- What it is
Many hosts, one public address.
A network's internal addresses often cannot be used outside it. The form of NAT taught here, Network Address Port Translation (NAPT), maps many private addresses and their TCP and UDP ports onto a single public address and its ports, so many hosts can reach outside networks through one address. A simplification: NAT comes in other forms too. Basic NAT maps addresses only, and a NAT device can hold more than one public address. This lesson covers the common many-to-one case.
Source: RFC 3022, Traditional IP Network Address Translator, Abstract and section 1
- How it works
Swap out, swap back.
When a private host sends a packet, the NAT router replaces the source address and port with its public address and a port it assigns, and records that mapping. In the RFC's own example, host 10.0.0.10 sending from port 3017 appears outside as 138.76.28.4, port 1024 (the RFC says "say 1024", so the port is just an example). When the reply arrives at that public port, the router looks up the mapping and puts the private address and port back before passing the packet on. The mapping is created when a private host first opens a session. The RFC describes this setup as allowing only sessions that start on the local network, unless a mapping for inbound access is configured on purpose.
- Why it matters
Out, yes. In, no. Not access control.
In AWS, a public NAT gateway sits in a public subnet and lets instances in private subnets connect to the internet, while those instances cannot receive unsolicited inbound connections from the internet. That is address translation, not access control. AWS says you cannot associate a security group with a NAT gateway: security groups go on your instances, and a network ACL controls traffic to and from the subnet. The RFC itself describes NAT as a privacy mechanism, since outside hosts cannot see the private addresses, and notes the same hiding makes it harder to trace a misbehaving internal host.
Source: AWS, Amazon VPC User Guide, NAT gateways; NAT gateway basics; RFC 3022, section 6.1
The takeaway: NAT lets many hosts share one public address by rewriting addresses and ports and remembering the mapping so replies can be matched back. It hides private addresses, but it does not decide who may connect to what. That is the job of security groups and network ACLs. Also useful to know: AWS also offers private NAT gateways for connecting to other VPCs and on-premises networks, and NAT gateways have connection limits per address and destination.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
Many private devices can share a single public address. Here's how NAT makes that work. Private addresses often can't be used outside a network. So a NAT router rewrites each device's private address and port to one public address and port. Many hosts end up sharing a single public address. When a private host sends a packet, the router swaps its address and port for the public address and a port it assigns. It records that mapping. When the reply comes back to that public port, the router looks up the mapping and swaps the private address and port back in. In AWS, a NAT gateway lets private instances reach the internet. But the internet can't start connections to them. That's still not access control. Security groups and network ACLs do that job. So, NAT lets many hosts share one public address. It rewrites addresses and ports, and remembers the mapping for replies. And it hides addresses, but it doesn't control access.
Narrated with an AI voice.
