Five phones, one home address
A family has five phones, a games console and a smart TV. All of them are online at once.
Yet the internet sees only one address for the whole home. Every video still reaches the right screen.
The home router does a clever swap on every packet. This lesson shows how.
By the end of this lesson
Note
I can explain how many devices share one address.
Key words
| Word | What it means | Example |
|---|---|---|
| Public address | an address that is used on the internet | |
| Gateway | the router between an inside network and the internet | |
| NAT | network address translation: swapping the addresses in a packet | |
| Source port | the number that says which connection a packet belongs to | 50001 |
| NAT table | the gateway's list of which connection belongs to which device | |
| Port forward | a rule that sends one outside port to one inside device |
The cells students fill in are left blank in this preview.
A private address cannot get a reply
Devices at home use private addresses. No router on the internet has a route to them.
So a request from 192.168.1.20 can reach a server. The server's reply has nowhere to go. It is lost.
Meet the three machines
netlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the outside server from inside
sudo ip netns exec lan curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask the same server from the gateway
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 http://203.0.113.2:8000/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
One request is answered, one is not
The status shows gw with two addresses: 10.0.0.1 inside and 203.0.113.1 outside. The inside machine lan is 10.0.0.2.
From lan, curl waits three seconds and prints Connection timed out. The server has no route back to 10.0.0.2.
From gw, the server answers at once: outside-server: you are 203.0.113.1.
The gateway swaps the source
With NAT, the gateway changes each packet on the way out. It puts its own public address in place of the private one.
It keeps the source port when it is free, and picks another one when two devices clash. It writes the swap in its NAT table.
When a reply comes back, the gateway looks up the port and swaps the address back.
Worked example: two phones, one address
| Device | Leaves the phone from | Leaves the gateway from |
|---|---|---|
| Phone A | 192.168.1.20 port 40000 | 198.51.100.5 port 40000 |
| Phone B | 192.168.1.21 port 40000 | 198.51.100.5 port 40001 |
| Console | 192.168.1.30 port 52000 | 198.51.100.5 port 52000 |
The cells students fill in are left blank in this preview.
Read what the gateway remembers
sudo ip netns exec gw conntrack -LShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The gateway tracks each connection
Each line is one connection the gateway has seen. The request from lan shows SYN_SENT and [UNREPLIED]: no reply came.
The gateway's own request shows TIME_WAIT and [ASSURED]: it was answered and closed.
Each line lasts about two minutes. This memory is what NAT uses to send each reply to the right device.
A port forward lets one thing in
NAT works for connections that start inside. A request that starts outside matches no line in the table, so it is dropped.
To run a game server at home, you add a port forward: outside port 25565 goes to one console, for example.
The gateway's firewall rules say what may come in at all.
Read the gateway's firewall rules
sudo ip netns exec gw nft list rulesetShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think NAT is what keeps strangers out. NAT only swaps addresses. The firewall rules decide what is allowed in. In this ruleset, policy drop on the forward chain is what blocks the outside.
Going further: a table that fills up
A port is a number from 1 to 65535. Suppose a gateway only lends ports from 50000 to 50009.
How many connections can it hold at once? Use your next_free_port to fill a table until the answer is "full". What would a busy home notice?