Search code examples
network-programmingtcproutesnat

How NAT handles return traffic


There is a Static NAT rule that achieves the following.

(for the question, let's assume the WAN subnet has a subnet of 1.1.1.1/24)

Inbound traffic to the WAN interface on port X to 1.1.1.6 gets NAT'ted to LAN IP 192.168.0.1.

Now this isn't a 1-1 NAT rule, just a Static NAT for the inbound traffic. When return traffic is sent back to the client, does the firewall know to NAT traffic back to the client with the source IP of 1.1.1.6 ?

I'm assuming it has to? As TCP is a two-way protocol, if the client received traffic back on a different IP to the IP it sent the traffic to, it would drop it?


Solution

  • A static 1:1 NAT defines which inside address translates to which outside address, so there is nothing for the NAT router to figure out; it is already given to the router in the configuration. It merely has to translate the destination address on outside sourced packets, and the source address on inside sourced packets; a simple, static, table lookup.

    It gets more complex when the NAT isn't static or 1:1. Then the NAT router then needs to build tables on the fly, and create timeouts for the table entries.