 Solution

Network address translation lets a router join a private Internet Protocol address realm to the public Internet. On outbound packets it replaces the private source IP address by a public IP address. On returning packets it applies the inverse mapping to the destination IP address, then forwards to the internal host. Basic network address translation changes addresses; the common many-to-one form, network address and port translation, also changes the source transport port so several internal hosts can share one public IP address.^[ref]

For example, suppose the public-facing router has IP address 198.51.100.7. An internal TCP exchange might be translated as follows; the addresses are illustrative:An entry records that traffic returning to external transport port 62001 belongs to 10.0.0.2:49152 for this transport protocol. The destination on the return path is rewritten accordingly. A second internal host using the same private transport port can receive a different public transport port. The actual lookup may also use the remote endpoint, depending on the mapping and filtering policy.

The router must update the IPv4 header checksum, and any affected TCP or UDP checksum: transport checking includes the relevant IP addresses as well as the transport header. Bindings may be allocated dynamically and removed after inactivity or observed termination. Traffic for a live exchange must traverse a translator that possesses the binding, or equivalent shared information.

An unsolicited incoming packet generally has no dynamic inverse mapping, so exposing a private service usually needs a configured mapping or port forwarding. Application data that embeds a private IP address can also need special handling. Address translation saves public address space, but changes the addressing visible to the two endpoints and can disrupt an exchange if its mapping disappears. Its essential mechanism is