What is NAT Algorithm and its Connection Tracking Table?

When a private network with multiple private IP addresses connects to the Internet with a single shared public IP address, router has to perform NAT (Network Address Translation) tasks using the following algorithm.

Let's use the following diagram to describe the NAT algorithm and its connection tracking table.

1. Assume that private metwork uses IP range of 192.168.0.0/16 with 192.168.1.1 for the gateway, which is the router performing the NAT job.

2. Assume that the public IP address given by the ISP is 145.12.131.7.

3. Host 191.168.100.3 sends HTTP request to http://www.yahoo.com which is 209.131.36.158:80. The request message header contains the following info:

Source: 191.168.100.3:3855 (random port picked by browser)
Dest: 209.131.36.158:80

4. The network interface sends the message to the gateway at 192.168.1.1.

5. Since NAT function is turned on, it will do the NAT job:

• Pick up a free port, 6282, on the public IP.
• Create an NAT mapping of 191.168.100.3:3855 = 145.12.131.7:6282 in the connection tracking table.
• Update the request message header by replacing "191.168.100.3:3855" with "145.12.131.7:6282".
• Forward the request message to the public Internet.

6. www.yahoo.com receives the request message and returns a response message with the following header info.

Source: 209.131.36.158:80
Dest: 145.12.131.7:6282

7. The router receives the response message and performs the reverse NAT job again:

• Find the NAT mapping entry that matches 145.12.131.7:6282 from the connection tracking table.
• Update the request message header by replacing "145.12.131.7:6282" with "191.168.100.3:3855".
• Forward the response message to the prviate network.

8. The host 191.168.100.3 receives the response message.

Additional security enhancements can be added to the above NAT algorithm to prevent other public hosts/ports to send messages to the mapped private hosts.

⇒ "ipconfig" and "ifconfig" Commands

⇐ Private IP vs. Public IP

⇑ IP Network

⇑⇑ Internet Connection - Frequently Asked Questions