How does NAT actually work step by step?
ben31833 · posted · 94 views
I understand the concept of NAT (private IPs to public) but the details confuse me. What are inside local, inside global, outside local, outside global? And how does PAT track which internal device made which request? A step by step walkthrough would really help.
- The inside/outside local/global naming is the hardest part. Just remember: "inside local" is the real private IP on your LAN (like 192.168.1.10). "Inside global" is what the internet sees it as (your public IP). The "outside" versions are usually the same — the real IP of the remote server. — itayitayy,
- PAT is the one everyone actually uses in the real world. Your home router does PAT right now — one public IP, and it uses port numbers to track which internal device made which request. PC1 gets port 40001, PC2 gets port 40002. When a reply comes back to port 40002, the router knows it goes to PC2. — 22maya2n2,
- Build a NAT lab here with 2 PCs behind a router. Configure ip nat inside source list 1 interface gi0/1 overload and watch the translation table with show ip nat translations. You'll see the port mappings appear in real time. It makes the whole concept concrete. — NivSa,
- Inside local = real private IP, inside global = public face. That two-word summary is going straight into my notes. The four terms always felt like they were designed to confuse people but this framing actually sticks. — ben31833,
- Just built the lab you described. The show ip nat translations output is so satisfying — you can literally watch the mappings appear as each PC pings out. Seeing the port numbers change per session makes PAT click instantly. — ben31833,
1 Answer
Think of it as the router rewriting addresses as packets cross the inside/outside boundary. Say inside host 192.168.1.10 browses 8.8.8.8, with PAT (overload) on the router's public IP 203.0.113.1.
- Packet leaves the host: src
192.168.1.10:50000, dst8.8.8.8:443. - It hits the router. The inside interface is marked
ip nat inside, the WAN isip nat outside— that's how NAT knows which direction to translate. - Router rewrites the source to
203.0.113.1and, because it's PAT, assigns a unique source port. It stores the mapping in the translation table (inside local ↔ inside global). - Forwards out. As far as the internet is concerned the traffic came from
203.0.113.1. - Reply returns to
203.0.113.1:<port>. Router looks up that port in the table, rewrites dst back to192.168.1.10:50000, forwards it inside.
The flavors differ only in the mapping:
- Static NAT — fixed 1:1.
- Dynamic NAT — 1:1 from a pool.
- PAT / overload — many inside hosts share one public IP, disambiguated by port. This is what home routers do.
Check the live table with show ip nat translations.
ariel.lahav22 · answered
- Worth adding: when connectivity breaks, `show ip nat translations` is the first place I look. Empty table usually means your `ip nat inside/outside` interface markings are missing or swapped. — Shira Sivroni,
Your answer
Posting questions and answers is included with every paid plan, from $15/mo. On the Free plan you can read, like, comment, connect and message. Compare plans →