Track 1 • Module G3 of 4 • Edge Translation & Security

NAT / PAT, Port Forwarding (DNAT) & Stateful Firewalls

How can dozens of devices inside your home or office (192.168.1.x) share a single Public IP Address without getting their traffic mixed up? And how does a Stateful Firewall let replies back in while keeping hackers out?

☎️
The Switchboard Extension Analogy: Your office only has one public phone number (203.0.113.5). When Laptop (.10) and Phone (.11) both call out at the same time, the PAT (Port Address Translation) switchboard tags Laptop's call with Extension :60001 and Phone's call with Extension :60002. When the outside server replies to :60002, the switchboard knows immediately to route it to the Phone!
Next: Module G4 (BGP & Internet Routing) → ← Prev: Module G2 (IPs & CIDR)
Interactive PAT Multiplexer, Port Forwarding & Firewall Simulator
🏠 Private LAN (RFC 1918) 192.168.1.0/24 • Not Routable on Internet 💻 Employee Laptop Priv IP: 192.168.1.10 Local Port: 50000 Browses 93.184.216.34:443 📱 Wi-Fi Smartphone Priv IP: 192.168.1.11 ALSO uses Port: 50000! PAT assigns unique WAN port! 🖥️ Internal Web Server (.50) Priv IP: 192.168.1.50:443 Only reachable from outside if DNAT Port Forwarding is ON! 🛡️ Edge Router: NAT/PAT + Firewall 1 Single Public WAN IP: 203.0.113.5 🔄 PAT (SNAT) Port Translation Table 192.168.1.10:50000 ⇄ 203.0.113.5:60001 192.168.1.11:50000 ⇄ 203.0.113.5:60002 💡 Even when two LAN devices pick the same local port (50000), PAT assigns distinct WAN ports (60001 vs 60002) to keep replies separate! 🚪 Port Forwarding (Inbound DNAT) WAN 203.0.113.5:443 → 192.168.1.50:443 All other inbound ports (like SSH :22) = DROPPED 🔒 Firewall Engine: STATEFUL INSPECTION ✓ Tracks TCP SYN → SYN-ACK → ESTAB ✓ Auto-allows return packets for active sessions 🛡️ Egress Rule: Block Malware Port 4444 Default Policy: Allow Outbound, Deny Uninvited Inbound 🌍 PUBLIC INTERNET 🌐 Public Web Server 93.184.216.34:443 Only sees WAN IP: 203.0.113.5:60001 / :60002 🧑🏽‍💻 Outside Caller / Bot 198.51.100.88 Calls 203.0.113.5:443 (Web) or scans 203.0.113.5:22 (SSH)
SNAT / PAT = Private LAN → 1 Public IP (Outbound) DNAT (Port Forwarding) = Public IP:Port → Internal Server