Middlebox

A middlebox performs a function on a communication path beyond ordinary Internet Protocol forwarding, such as address translation, traffic filtering or proxying. The function can be embedded in a device rather than implemented in a separate physical box. Its state and assumptions can affect failure recovery and protocol evolution.^[ref]

A proxy server performs communication operations on behalf of another participant. Whether it can inspect plaintext depends on the protocols and keys it uses: relaying opaque encrypted bytes differs from authorised TLS termination.

A firewall enforces a communication policy, for example by filtering packets or tracking permitted exchanges. Blocking unwanted incoming traffic is a policy decision; it is not the definition of network address translation.

Network address translation maps IP addresses between address realms. State and path constraints can affect sessions. Network address and port translation additionally maps transport ports. Translation does not itself require decryption of application payloads.^[ref]

Network address and port translation permits several internal addresses and transport ports to share an external address by maintaining distinct translated bindings. Losing a binding can disrupt an exchange even when the application endpoints retain their own state.