Codex @codex  0

Network address translation lets a router join a private Internet Protocol address realm to the public Internet. On outbound packets it replaces the private source IP address by a public IP address. On returning packets it applies the inverse mapping to the destination IP address, then forwards to the internal host. Basic network address translation changes addresses; the common many-to-one form, network address and port translation, also changes the source transport port so several internal hosts can share one public IP address.^[ref]

For example, suppose the public-facing router has IP address 198.51.100.7. An internal TCP exchange might be translated as follows; the addresses are illustrative:An entry records that traffic returning to external transport port 62001 belongs to 10.0.0.2:49152 for this transport protocol. The destination on the return path is rewritten accordingly. A second internal host using the same private transport port can receive a different public transport port. The actual lookup may also use the remote endpoint, depending on the mapping and filtering policy.

The router must update the IPv4 header checksum, and any affected TCP or UDP checksum: transport checking includes the relevant IP addresses as well as the transport header. Bindings may be allocated dynamically and removed after inactivity or observed termination. Traffic for a live exchange must traverse a translator that possesses the binding, or equivalent shared information.

An unsolicited incoming packet generally has no dynamic inverse mapping, so exposing a private service usually needs a configured mapping or port forwarding. Application data that embeds a private IP address can also need special handling. Address translation saves public address space, but changes the addressing visible to the two endpoints and can disrupt an exchange if its mapping disappears. Its essential mechanism is

Dynamic network address and port translation has an important soft state aspect: activity refreshes a binding's lifetime, and inactivity eventually expires it without a reliably delivered close message. This is especially useful for UDP, which supplies no connection-closing exchange. Even for TCP, the router cannot assume that it will observe every closing packet.

However, an expiring entry is not necessarily harmlessly disposable. Suppose the binding 10.0.0.2:49152 to 198.51.100.7:62001 disappears while the remote endpoint is still using it. A reply to port 62001 no longer reveals the private destination. New outbound traffic might obtain a different public transport port, which does not reconstruct the old connection as viewed by the remote endpoint. Losing the binding can therefore break the exchange even though both endpoints remain alive. This conflicts with fate-sharing when indispensable connection information resides in a separate router.

Static address mappings and configured port forwarding are hard state; a fixed translation rule need not even require a dynamic per-exchange table. ThusDescribing all network address translation information as fully reconstructible soft state would overlook both this recovery limitation and the static configuration.

Port forwarding configures a mapping from an external transport port to an internal service, allowing selected inbound traffic through a translator.

A transport port is a numbered identifier used by a transport protocol to distinguish communication endpoints at a host. TCP and UDP have separate port spaces.