← Interview Prep

NAT — Theory

Network Address Translation end to end: static/dynamic NAT and PAT/NAPT, SNAT vs DNAT, Cisco inside/outside terminology, how PAT rewrites and tracks flows, checksum recompute, what breaks (ALGs, IPsec NAT-T, hairpinning), NAT behavior types & traversal (STUN/TURN/ICE), CGNAT and NAT64.

NAT rewrites addresses (and usually ports) as packets cross a boundary — the workaround that let a shrinking IPv4 space serve billions of hosts. It's simple in the common case and full of edge cases interviewers love: what breaks end-to-end, why some protocols need help, and how peers behind NAT ever talk to each other.

The one that matters is PAT / NAPT (a.k.a. "NAT overload"): many private hosts share one public IP by multiplexing on source port. The router keeps a translation table and reverses the rewrite on the return packet.

Flavors

Type	What it does
Static NAT	Fixed 1:1 mapping (one private ↔ one public). Used to publish a server.
Dynamic NAT	Many private → a pool of public, first-come; still 1:1 while active.
PAT / NAPT (overload)	Many private → one public, disambiguated by port. The home/office default.
SNAT vs DNAT	Rewrite the source (outbound, hide clients) vs the destination (inbound, port-forward / load-balance).

Cisco's four-address vocabulary: inside local (real private), inside global (the public it's translated to), outside global (real Internet host), outside local (how the outside appears inside) — "inside/outside" = whose host, "local/global" = which side of the NAT you're looking from.

How PAT works

Outbound packet 10.0.0.5:51000 → 93.184.216.34:443 hits the NAT.
NAT rewrites the source to 203.0.113.1:62000, stores the mapping (10.0.0.5:51000) ↔ (203.0.113.1:62000) keyed by the 5-tuple, and forwards.
The reply to 203.0.113.1:62000 is matched in the table and rewritten back to 10.0.0.5:51000.

Checksums recompute: changing the IP (and port) forces the router to fix the IP header checksum and the TCP/UDP checksum (which covers a pseudo-header of the IPs). See Protocol Headers.
Port exhaustion: ~64k ports per public IP cap concurrent flows; busy NATs need a pool or CGNAT.
Timeouts: idle mappings age out (TCP long, UDP short) — a source of "connection works then dies".

What NAT breaks (and ALGs)

End-to-end addressing is gone — the point of NAT. Inbound is only possible via a static mapping / port-forward.
Protocols that embed IPs/ports in the payload — FTP (PORT), SIP/RTP, some ICMP — break unless an ALG (Application Layer Gateway) rewrites the payload too. ICMP has no ports, so NAT tracks it by the Identifier field.
IPsec AH can't traverse NAT (it authenticates the IP header); ESP needs NAT-T (UDP 4500 encapsulation).
Hairpinning / NAT loopback: two inside hosts reaching each other via the public IP need the NAT to turn traffic back on the same interface — not all devices do it.

NAT types & traversal (P2P)

For peer-to-peer (VoIP, gaming, WebRTC) the NAT's behavior decides whether hole-punching works:

Behavior	Return traffic allowed from…
Full-cone	Any external host, once a mapping exists (easiest to traverse).
Restricted-cone	Only IPs the inside host already sent to.
Port-restricted	Only the same IP+port the inside host sent to.
Symmetric	A new mapping per destination — hardest; often needs a relay.

STUN discovers your public mapping, TURN relays when direct fails, and ICE tries candidates in order — the WebRTC stack.

Carrier-grade & IPv6

CGNAT (NAT444): ISPs NAT subscribers behind shared public IPs; port-block allocation + logging are needed for lawful traceability.
NAT64 / DNS64: let IPv6-only clients reach IPv4 servers — an IPv6 transition tool, not classic NAT. See IPv6.
NAT is not a firewall — though PAT implicitly drops unsolicited inbound (no mapping), it makes no policy decisions. Don't rely on it for security.

Likely interview questions

Static NAT vs dynamic NAT vs PAT — when each?
How does PAT let 500 hosts share one IP, and what's the hard limit? (source ports; ~64k)
Why must NAT recompute L4 checksums? (pseudo-header contains the IPs)
Which protocols break through NAT and why? (embedded IPs — FTP/SIP; needs ALG)
SNAT vs DNAT / port forwarding?
What is symmetric NAT and why is P2P hard through it? (per-dest mapping; STUN/TURN/ICE)
Is NAT a security feature? (no — but implicitly blocks unsolicited inbound)
What is CGNAT and what does it complicate? (shared IPs; logging/traceability)