Questions: Network Address Translation (NAT)

Question 1

A device at 192.168.1.100 sends an HTTP request to a web server. The server replies to the NAT router's public IP address. How does the router know to forward the reply to 192.168.1.100 rather than any other internal device?

• A. The web server records the originating private IP in its response headers
• B. The router's translation table maps the external port used for this connection back to the correct internal device and port
• C. IPv4 routing automatically routes packets addressed to public IPs back to the originating private device
• D. The internal device sends a follow-up packet to claim the reply before the router can deliver it elsewhere

Answer: (B)

The translation table is the core mechanism of NAT. When the device initiates the connection, the router records the mapping: internal IP + internal port ↔ external (public) IP + external port. When the server's reply arrives addressed to the public IP and external port, the router looks up that external port in its table, finds the corresponding internal entry, rewrites the destination to 192.168.1.100:internal-port, and forwards the packet inward. Without this stateful table, the router would have no way to determine which internal device originated the flow.

Question 2

A game server on the internet wants to initiate a direct connection to a gaming PC behind a home NAT router. What problem does NAT create?

• A. NAT blocks all UDP traffic, which games rely on for low-latency communication
• B. No translation table entry exists for an unsolicited inbound connection, so the router drops the packet with no destination to forward it to
• C. The game server can still reach the PC directly by using the PC's private IP address through the public router
• D. NAT blocks all connections on port numbers above 1024, which most game servers use

Answer: (B)

NAT translation table entries are created when connections are initiated from inside. When the game server sends an unsolicited packet to the router's public IP, no matching entry exists in the table, so the router has no internal address to forward it to and drops the packet. This is often called the 'NAT traversal' problem. Solutions include port forwarding (manually configuring a permanent table entry for a specific internal server), UPnP (letting the internal device request a port mapping automatically), or NAT hole-punching techniques where both peers coordinate through a third party.

Question 3

With Port Address Translation (PAT), each device on an internal network should be assigned a unique public IP address to connect to the internet simultaneously.

• T. True
• F. False

Answer: False

PAT's entire purpose is to let many internal devices share a single public IP address simultaneously. It distinguishes concurrent connections by assigning each a unique external port number in the translation table. When two devices both connect to port 80 of web servers, the router maps their connections to different external port numbers (e.g., 192.168.1.100:43210 ↔ public-IP:54001 and 192.168.1.101:49150 ↔ public-IP:54002). The external port number identifies which internal flow a reply belongs to, allowing hundreds of simultaneous connections through one public address.

Question 4

NAT provides a basic security benefit by preventing unsolicited inbound connections from reaching internal hosts.

• T. True
• F. False

Answer: True

Because the translation table only contains entries for connections initiated from inside, packets arriving from outside with no matching entry are dropped. This means external hosts cannot spontaneously connect to internal devices — they have no way to reach a device that hasn't already reached out. This is a side effect of NAT's address-translation mechanism, not a designed security feature (for that, you want a proper stateful firewall), but it provides meaningful protection against unsolicited inbound probes and connection attempts.

Question 5

Explain step by step how a NAT router routes a reply packet from an external web server back to the correct internal device.

Model answer: 1) An internal device (e.g., 192.168.1.100:49200) sends a request to an external web server. 2) The NAT router intercepts the outgoing packet, replaces the source address with its own public IP and assigns an external port (e.g., public-IP:54001), and records the mapping (public-IP:54001 ↔ 192.168.1.100:49200) in its translation table. 3) The web server sends its reply to public-IP:54001. 4) The router receives the reply, looks up port 54001 in its translation table, finds the mapping to 192.168.1.100:49200, rewrites the destination IP and port accordingly, and forwards the packet to the internal device. The internal device receives the reply as if no translation occurred.

The statefulness of this mechanism — maintaining the table of active mappings — is what distinguishes NAT from simple routing. It also explains NAT's limitations: the table entry expires when the connection closes, so there is no persistent way to reach an internal host from outside. Static NAT or port forwarding adds permanent entries to solve this for servers.