Introduction

NAT protocol stands for Network Address Translation protocol. It is the protocol that helps us use a single global IP address across our local area network and use it to surf the internet. As you know, the devices within our network have local IP addresses, and only the router handles the global IP address. NAT is the protocol that translates our local IP and port to a table and then associates it with the global IP and port to forward the traffic requested by a specific device.

History and Evolution

In the early days of the Internet, the number of devices connected to the Internet was very low. Each device required a global IP address to connect to the Internet and carry out its activities. Everything was going well, but as the Internet started growing, more and more devices got connected. This eventually led to the depletion of IP addresses, as at that time, only IPv4 was available, which could provide IP addresses to a maximum of 4.3 billion devices(4,294,967,296 ).

This raised a concern about what would happen to the internet when the number of devices surpassed this limit. Another issue arose—each global IP address required the router to maintain a routing table to keep track of them. The more global IP addresses there were, the larger the routing tables became, which in turn slowed down the internet.

To solve these problems, RFC 1631 introduced NAT (Network Address Translation) in 1994 as a ‘short-term solution’ to address IP address depletion and routing complexity, as it allowed multiple devices to share the same global IP address and access the internet, limiting the routing table to handle just one global IP address.

As the problem of IPv4 became more pressing, it paved the way for the creation of the IPv6 protocol, which uses a 128-bit address and can provide about 340 undecillion IP addresses. While it solves the issue of IP address depletion, it has not been fully adopted or replaced IPv4 due to compatibility issues with IPv4 and the cost of building the infrastructure to support IPv6.

Initially NAT protocol was used in smaller networks, but as the internet grew the adoption of the protocol became widespread and eventually it became an industry standard as it get implemented routers, which became industry standard features in consumer-grade networking hardware.

Types of NAT

There are three main types of NAT:

1. Static NAT
2. Dynamic NAT
3. Port Address Translation (PAT) / Overloaded NAT

1. Static NAT

Static NAT is a kind of NAT technology that helps bind a local device or local IP to a global IP address, and this mapping does not change. It is fixed, meaning whenever the device connects, it will use the same global IP address. One important point is that if you need to connect two or more devices using static NAT, you will need an equal number of global IP addresses.

Now, you might wonder what the use of this is if it doesn’t solve the IP depletion problem or any other issues mentioned earlier. It can be useful for organizations that want to assign a fixed public IP to a private device.

You may also have a doubt, if the network has more than one device, is it still possible for other devices to browse the internet like a normal network? Yes, it is. Other devices use PAT (Port Address Translation), also known as port forwarding, so they can browse the internet normally. However, the port that is fixed to the global IP cannot be used by other devices.

It is normally used by servers to stay always connected to a fixed IP address, making them easily reachable by the public using the same IP address.

For example, if you connect the local device with the IP address 192.168.2.65 to a global IP 203.0.113.X.X on port 80, then other devices can use the same global IP with different ports to communicate with internet services.

2. Dynamic NAT

Dynamic NAT is another type of NAT developed after Static NAT to address the problems of IP depletion and routing table issues. It assigns a pool of global IP addresses to local devices based on which global IP is available. For example, if there are 4 global IP addresses and 4 devices, there is no problem. If there are more than 4 devices, the global IP addresses will be assigned to the devices that are active at that time. If not all devices are active simultaneously, this works smoothly. However, if every device in the network is active and their number exceeds the available global IPs, some devices will have to wait to send packets, or their packets may simply be discarded. Thus, it slightly solves the problem by intelligently assigning IPs to active devices.

The pool of IPs that get assigned may be fixed or dynamic, but in most cases, it will be fixed because it is easier for the NAT to maintain and manage. This is due to the manual effort required each time the global IP is changed.

Now, you may have a doubt whether a fixed IP is assigned for a lifetime or for a fixed period of time. In some cases, you can request the ISP to always assign you a specific IP (you may have to pay more), and the rest depends on the ISP’s policies. In some cases, as long as you continue paying the ISP, the IP may not change.

Now you may ask, what if we stop paying for a month and then resume? Will we get the same fixed IP? Maybe not, as it always depends on the ISP’s rules. If they assign that IP to someone else, you may have to use a new one or request the ISP to assign the same IP again.

As you know from the content above, both Static NAT and Dynamic NAT have their own limitations and do not completely solve the IP depletion or routing problems. So, the next technology developed based on NAT is PAT (Port Address Translation).

3. Port Address Translation (PAT) / Overloaded NAT

Port Address Translation (PAT), also known as Overloaded NAT, is the most common and widely used form of NAT today. Unlike Static NAT or Dynamic NAT, PAT is specifically designed to efficiently address the problem of IPv4 address exhaustion.

PAT enables multiple local (private) devices to share a single public IP address by mapping each device’s traffic to a unique port number on the router’s public IP.

Here’s how it works:

When a device (e.g., 192.168.1.10) tries to access the internet, PAT modifies the source IP address to the public IP (e.g., 203.0.113.5) and assigns a unique source port number (e.g., 45100).

The router maintains a translation table to track which internal device is using which port.

When a response arrives from the internet, the router uses the port number in the response to identify the corresponding internal device and forwards the response accordingly.

This mechanism allows thousands of devices to access the internet using a single global IP address, with each session uniquely identified by a distinct port number.

How NAT Works?

Packet flow in NAT

This is how a packet flows in a NAT-enabled network:

1. A device (e.g., 192.168.1.10) sends a request to access a website.
2. The packet reaches the NAT-enabled router.
3. The router changes the source IP from the private IP (192.168.1.10) to the router’s public IP (e.g., 203.0.113.5) and assigns a unique port number.
4. The modified packet is sent to the internet.
5. When the response comes back, it includes the public IP and port.
6. The router checks its NAT translation table and maps the port number back to the correct private IP.
7. The packet is forwarded to the original device inside the network.

Translation table and mapping process

To keep track of which internal IP and port mapped to which public IP and port, the router maintains a NAT translation table. This table includes:

• Private IP address
• Private port
• Public IP address
• Public port
• Protocol (TCP/UDP)

Each outgoing connection creates a new entry. When a packet returns, NAT uses this table to translate the destination IP and port back to the original private IP and port.

NAT and IP masquerading

IP Masquerading is a form of NAT (especially in Linux systems) where multiple devices appear to the outside world as a single device. All internal devices are “masqueraded” behind a single public IP.

This is commonly used in home and office routers. From the perspective of the internet, all internal traffic seems to originate from the same public IP address, making internal devices invisible to the outside world which adds a layer of security.

In short, IP Masquerading is basically PAT in Linux systems.

Advantages and Disadvantages of NAT

Pros:

• IP Address Conservation
• Security Benefits
• Flexibility

IP Address Conservation

As you know now, NAT is an ideal solution to the problem of IP address depletion, as it helps address the limitation of available IPv4 addresses by using a single global IP across a local area network.

Security Benefits

NAT works as a barrier between the internal network and the external network, as it helps prevent directly exposing private IP addresses to the internet, making it harder for external attackers to target individual devices within the local network. Any incoming connections are typically blocked unless specific rules are set up.

More info: The statement “Any incoming connections are typically blocked unless specific rules are set up” is true because NAT, by default, blocks all incoming traffic from the external network to the internal network. This is because the internal devices are using private IP addresses that are not directly accessible from the internet. Without specific rules or configurations, the NAT device doesn’t know how to route external traffic to a specific device on the internal network. Therefore, it blocks the incoming connections by default for security purposes. For some types of incoming traffic to access a device in the internal network, you must configure rules like port forwarding or DMZ (Demilitarized Zone). These rules instruct the NAT device to forward particular external traffic (such as HTTP requests on port 80 or SSH on port 22) to a specific device inside the network.

Flexibility

NAT allows flexibility in how devices are connected to the internet. Since the internal devices are using private IP addresses, the network can be easily restructured or expanded without affecting changes to the externally facing IP address. This flexibility helps in easily scaling the network, even if the number of internal devices grows rapidly.

Cons:

• Slower Performance
• Breaks end-to-end connectivity
• Issues with certain protocols

Slower Performance

The NAT protocol can result in slower network performance, as the traffic passing through the router needs to have its IP address modified on every packet. This takes extra time, especially when there are many packets.

Breaks end-to-end connectivity

Normally, on the internet, devices can communicate with other devices directly, but when we introduce NAT as a solution to our problems, it disrupts direct communication, making it harder for devices to establish direct connections with each other.

Issues with certain protocols

Some protocols rely on direct communication between devices, such as those used for voice calls or online gaming. However, NAT can cause problems in some cases as it changes the IP address and interferes with the protocols’ ability to function properly.

NAT and Cybersecurity

As we all know, Strawhat Hackers Blog is a website that focuses on content from the perspective of the cybersecurity field. So, let’s dive deeper into the protocol through the eyes of a cybersecurity aspirant.

How NAT enhances security

NAT protocol enhances security by hiding internal IP addresses, making it harder for malicious hackers to attack internal devices directly. Since the private IP address is not exposed to the internet, it reduces direct exposure. As I mentioned in its advantages, it also restricts incoming traffic, thus stopping unsolicited traffic.

NAT as a basic firewall

Only traffic that originates from the internal network is allowed back, creating a one-way flow, which acts like a basic firewall.

Common security misconfigurations in NAT

• Improper port forwarding
• Overuse of Public IP for Multiple Devices
• No logging or monitoring

Improper Port Forwarding

If you are already in the field of cybersecurity and have used the tool Nmap, then I don’t have to explain why unnecessary open ports make your device more vulnerable to attackers. But if you are new to the field, just understand that hackers love open ports. If they find one, they try to enumerate it to gain access to the system, which can result in your system being compromised.

Don’t allow unnecessary port forwarding, as it increases the attack surface of your device. Only forward the ports that are absolutely necessary. If there is any way to access sensitive ports like SSH or RDP, it can be very harmful to your system, as these are easier to exploit by a skilled hacker if any vulnerabilities exist.

Another common misconfiguration is keeping old port rules even after the related service is no longer active. Some fixes you can apply to address this issue are:

• Only forward the ports you really need
• Turn off port forwarding when it’s no longer required
• Use strong passwords and IP restrictions if you must expose a service

By maintaining these fixes and understanding the problems that your choices may raise, you can significantly reduce the risk.

Overuse of Public IP for Multiple Devices

Normally, NAT allows a global IP to be shared by a pool of devices connected to a local network. But what happens when you increase the number of devices connected to the same public IP by expanding your Local Area Network (LAN)? It can lead to another security misconfiguration.

The problem is simple, more devices mean more entry points for an attacker. If there is no separation or segmentation between casual and sensitive devices, then compromising even a single device can give the attacker an upper hand, allowing them to spread to other devices on the network.

Two effective solutions for this issue are:

• If you’re running multiple public services, consider using a reverse proxy or VPN
• Use DMZs or VLANs to isolate critical systems

No logging or monitoring

If you have no logs or no monitoring system to know what has happened in your network or if any suspicious packets tried to get in, then you will have no idea of what is happening in your system. So, if a breach occurs, you won’t know the “who, what, when, where, and how” of the attack. There will be no way to identify affected assets, compromised credentials, or lateral movement.

Other than this, if you can’t detect suspicious activity in real-time, you’re giving attackers free roam of your systems. The detection delay will result in more damage to your network.

Many regulations like GDPR, HIPAA, and PCI-DSS require logging and auditing. If you lack this, it can lead to legal and financial consequences, especially if you are running a public service.

Some fixes we can apply in the first place to stop this problem are:

• Enabling proper logging across all network layers
• Using centralized logging systems (log aggregation)
• Implementing monitoring and alerting

By applying these measures, you can secure your network from the above problems.

Known Bugs and Vulnerabilities in NAT

Some of the common bugs and vulnerabilities that have occurred in the NAT protocol in previous years are:

• NAT Slipstreaming
• NAT Pinning Attack
• UPnP NAT Vulnerabilities
• CVE-listed NAT Exploits
• NAT and DNS Rebinding Attacks
• NAT and VoIP Security Issues
• NAT Table Exhaustion Attacks

NAT Traversal and Bypassing Techniques

These are some of the techniques used for nat traversal and bypassing:

• STUN (Session Traversal Utilities for NAT)
• TURN (Traversal Using Relays around NAT)
• UPnP (Universal Plug and Play) security risks
• VPN and NAT compatibility issues

Best Practices for Secure NAT Implementation

• Hardening NAT configurations
• Avoiding UPnP vulnerabilities
• Logging and monitoring NAT traffic

Conclusion

Here is everything you want to know about the NAT protocol, presented in a more interesting and simple way for people ranging from beginners to advanced users.