How a packets returns when using NAT

[alayme112]

Hello, I'm studying for my CCNA certification and I have a doubt about NAT. I haven't found yet an explanation on internet.

The scenario is simple, I have a PC using a private address 192.168.10.1 and the router performs dynamic NAT. If the Wan interface of the router has the IP 161.10.10.1 and the PC's address is translated to another IP address from the pool, for example 161.10.10.2. The packet should have as source address 161.10.10.2 and any destination address.

When the remote host sends a reply, the packet has as source addres the IP of the remote host and as destination address the IP 161.10.10.2. My question is, if the destination address is 161.10.10.2 because of NAT, how does this packet knows that it have to reach the Wan interface of my router with IP address 161.10.10.1

I'd really appreciate your help, thanks.

[rais]

This works because the ISP assigned you multiple addresses and it knows all assigned IPs are to be routed to a particular next-hop [.1, in your example.].

 Internet edge router/device would proxy-arp for .2 once configured to do so.

 HTH.

[cheeseburger]

Hello alayme112,

I think you are more asking about a default route or a default gateway. In your simple topology, the WAN interface is your public IP and that router is also the default gateway for your LAN. Let's take a look at what the IP headers will look like if you were to ping Google DNS from your PC using the private address of 192.168.10.1:

1st packet from PC:

ip src: 192.168.10.1  |  ip dst: 8.8.8.8

Packet hits router (default gateway) and NAT takes place:

ip src: 161.10.10.1    |  ip dst: 8.8.8.8

Packet returns from Google into your router:

ip src: 8.8.8.8            |  ip dst: 161.10.10.1

router performs NAT and sends on to your PC:

ip src: 8.8.8.8            |  ip dst: 192.168.10.1

In your simple topology and with a home router, the NAT device will not NAT to another public IP, it will NAT between public and private IP. The router then has a default gateway (port labeled "Internet") and it's configured to 0/0 all traffic with that egress interface.

[paul driver]

Hello

---

@alayme112 wrote:

. My question is, if the destination address is 161.10.10.2 because of NAT, how does this packet knows that it have to reach the Wan interface of my router with IP address 161.10.10.1

I'd really appreciate your help, thanks.

---

The reason is that the destination address subnet 161.10.10.x would be advertised to other wan routers and as such the replying host own attached router would most probably have a valid route in its route table or be aware of another router that has a valid route to 161.10.10.x to be able send back a reply.

Once it hits your wan router , Nat will be perform and then routed towards your internal host.

[Richard Burts]

I like the explanation from Paul but I would approach it a bit differently. When your PC sends the packet toward the Internet the router will perform translation of the address and will create an entry in its translation table that associates the private IP of your PC with the public IP of 161.10.10.2. The router then sends out the packet with the translated source address. The destination sends a response with its own public IP as the source and 161.10.10.2 as the destination. Your ISP will route that packet to your router. Your router will look at the destination address of 161.10.10.2. will look into its translation table, and will translate the destination address back to your PC private address and route the packet to your PC.

HTH

Rick