Ravindra BagaleCourses & study guides

1. IP Addressing: IPv4, Subnets, Public and Private IPs

1.8 NAT (Network Address Translation)

By Last updated:

Class madhe students vichartat: "Sir, majha laptop 192.168.1.5 dakhavto pan website la vegla IP disto, kasa?" Uttar – NAT. Samjla ka? Chala baghu.

Why: Hundreds of devices on a institute network use private IPs, but the institute may have only a few public IPs. NAT lets many private devices share one public IP.

How: The router rewrites the source address of outgoing packets from the private IP to its public IP and keeps a translation table so replies go back to the correct device. The variant that also changes ports (many-to-one) is called PAT or NAT overload.

  Private LAN (192.168.1.0/24)                 Internet
 +------------------+
 | Laptop           |  src 192.168.1.10:50001
 | 192.168.1.10     |------+
 +------------------+      |      +-------------------+   src 198.51.100.7:61001
                           +----->|  NAT Router       |----------------------->  google.com
 +------------------+      |      |  Public 198.51.100.7|<-----------------------
 | Phone            |------+      +-------------------+   reply to 198.51.100.7:61001
 | 192.168.1.11     |               NAT table:
 +------------------+               192.168.1.10:50001 <-> 198.51.100.7:61001
NAT type Mapping Example
Static NAT 1 private ↔ 1 public (fixed) EC2 public IP / Elastic IP mapping
Dynamic NAT private ↔ one from a pool of public IPs Enterprise routers
PAT / NAT overload many private → 1 public using ports Home Wi-Fi, AWS NAT Gateway

Why this matters for security

NAT hides internal addresses and, by default, blocks unsolicited inbound connections – helpful, but it is not a firewall policy. For investigations it matters a lot: many users behind one public IP means a single IP in a log may represent a whole office. On AWS, a NAT Gateway lets private servers download updates without being reachable from the internet.

Ravindra Bagale's Tip

NAT la firewall samju naka. Khup students mhantat "NAT aahe mhanje mi safe" – pan port forwarding kela, kiwa aat malware aala, tar NAT kahich thambavat nahi. NAT fakt address badalto; security sathi firewall rules aani security groups lagtat.

Lab

On any Linux machine run ip -4 addr, hostname -I and curl -s https://checkip.amazonaws.com. Explain in two lines why the two IPs are different.

Thodkyaat sangaycha tar

  • IP = network location of a host; IPv4 = 32 bits in four octets; subnet mask splits network and host parts.
  • Classes A/B/C/D/E are historical; 127.0.0.0/8 is loopback. CIDR /n gives 2^(32−n) addresses.
  • Subnetting = segmentation; first and last address of a subnet are reserved (AWS reserves 5).
  • DHCP gives dynamic addresses (DORA); servers need static addresses (Elastic IP on AWS).
  • Private ranges (RFC 1918): 10/8, 172.16/12, 192.168/16. NAT lets many private hosts share one public IP – but NAT is not a firewall.

Samjla ka? Nasel tar punha vacha – aani `/32` vs `/0` cha farak kunalahi samjavun sanga. Aata pudhe jaauya: ports aani protocols.