Address translation roles
Static NAT establishes a fixed address mapping; dynamic NAT chooses from a pool; PAT uses transport ports to multiplex many flows onto fewer outside addresses. Translation is an addressing mechanism with state/lookup implications. It is not synonymous with a firewall or a proof that a host is safe.
Tuple tracking
A transport flow is identified by source address/port, destination address/port and protocol. Translation records original and translated tuple information. Return traffic needs a matching mapping; expired or ambiguous entries can break response delivery. Operational logs should retain enough tuple context to identify the original host.
Routing and applications
Both translated and untranslated portions need routes and appropriate policy. Some applications embed addressing information and require special handling, while inbound access typically needs explicit mapping and authorization. Do not broadly open management ports merely to solve a translation problem.
IPv6 distinction
IPv6 addressing does not require IPv4-style address scarcity sharing, but still needs routing, identity and security policy. The absence of NAT does not imply the absence of a firewall. This lesson’s PAT mapping is simplified and separate from legacy simulator forwarding.
Signal / protocol flow
- 1Inside client tuple
- 2Route / policy
- 3PAT mapping
- 4Outside session
- 5Reverse mapping
Technical terminology
- Inside local: original inside address
- Inside global: translated outside representation
- PAT: port address translation
- Tuple: addresses, ports and protocol
Worked example
10.0.0.10:5000 and 10.0.0.20:5000 connect to the same server. Map them to 203.0.113.9:40001 and :40002 so replies are unambiguous. 203.0.113.0/24 is documentation space, not a live endpoint here.
Configuration reference
# Declarative reference plan, not live configuration 10.0.0.10:5000 → 203.0.113.9:40001 10.0.0.20:5000 → 203.0.113.9:40002 Allow only required outbound services and matching return state.
Troubleshooting scenario
Outbound requests appear outside but replies never reach the client. Compare return tuple and mapping lifetime, policy evaluation address context and route symmetry. Avoid guessing that all inbound traffic must be allowed.
Knowledge check
Does PAT alone provide user authentication?
Related practice
References
Educational model — not real hardware, traffic or official certification.