Learn Computer Networking PNETLab - Network Address Translation (NAT / PAT)

#Introduction

All of your labs so far have used RFC 1918 private IPs. How can a network with thousands of private devices reach the Internet with only a few public IPs? The answer is in episode 16: Network Address Translation (NAT).

NAT is the mechanism that changes addresses as packets cross network boundaries. This episode discusses the need for NAT, its three types (static, dynamic, and PAT overload), then configures PAT for office internet access in PNETLab along with its verification.

#The Need for NAT (Network Address Translation)

#Conserving Public IPv4 and Hiding the Internal Architecture

Two main reasons NAT is used in almost every enterprise network:

• Conserving public IPs: one small block of public IPs can serve thousands of private devices simultaneously.
• Hiding the architecture: internal private IPs are never visible from outside, so the network structure cannot be mapped by adversaries.

As a bonus, NAT strengthens security: because internal hosts have no direct public address, inbound attacks can only reach the addresses intentionally opened.

#NAT Types

#Static NAT, Dynamic NAT, and PAT

• Static NAT: a 1-to-1 mapping between a private IP and a public IP. Used for internal servers that must be reachable from outside, such as web servers or mail servers.
• Dynamic NAT: private IPs are mapped to a pool of public IPs dynamically. The number of connections is limited by the number of IPs in the pool, so it is less efficient.
• PAT (Port Address Translation / NAT Overload): many private IPs are mapped to a single public IP by distinguishing port numbers. This is the NAT type used for internet access for all office users.

#PAT / NAT Overload Configuration on a Cisco Router

#Applying It in PNETLab

Build router R1 with interface g0/0 facing the LAN and g0/1 facing the ISP. Configure NAT overload:

configure terminal
interface g0/0
 ip nat inside
exit
interface g0/1
 ip nat outside
exit
ip access-list standard LAN_NET
 permit 192.168.10.0 0.0.0.255
exit
ip nat inside source list LAN_NET interface g0/1 overload

ip nat inside and ip nat outside mark the LAN side and the Internet side. The ACL LAN_NET determines which traffic is allowed to be NATed, and the last line performs overload on interface g0/1 — all users in 192.168.10.0/24 share that interface's single public IP.

#Verifying NAT

#show ip nat translations and show ip nat statistics

Run a ping or open a website from a PC on the LAN, then check the translation results:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local    Outside global
tcp 203.0.113.5:2214   192.168.10.10:2214 8.8.8.8:443      8.8.8.8:443
tcp 203.0.113.5:4723   192.168.10.11:4723 8.8.8.8:443      8.8.8.8:443

show ip nat translations displays the inside local (private IP) and inside global (public IP with port) pairs. You can see two different private hosts using the same public IP with different ports — proof that PAT is working.

R1# show ip nat statistics
Total translations: 2
Inside interfaces: GigabitEthernet0/0
Outside interfaces: GigabitEthernet0/1

show ip nat statistics displays a summary of the inside, outside, and number of active translations.

#Opening Inbound Access with Static NAT

For the internal web server 10.0.0.50 that must be reachable from the Internet, set up a one-way static NAT:

configure terminal
ip nat inside source static tcp 10.0.0.50 80 203.0.113.10 80
exit

ip nat inside source static tcp 10.0.0.50 80 203.0.113.10 80 translates requests to the public IP 203.0.113.10 port 80 to the internal server 10.0.0.50. Combining static NAT for servers and PAT for users is the most common NAT design in office networks.

#Common NAT Mistakes

The three most frequent problems: forgetting to mark the inside and outside interfaces, an ACL that does not allow the correct subnet, and missing the default route toward the ISP so packets get NATed but never reach their destination. If a ping fails even though the translation table is formed, check the routing first.

#Closing

Key takeaways:

• NAT conserves public IPs and hides the internal architecture.
• Static NAT for servers, dynamic NAT for a pool, PAT for many users.
• Mark interfaces with ip nat inside and ip nat outside.
• ip nat inside source list <acl> interface <if> overload is PAT.
• show ip nat translations proves translations are running.
• Combine PAT for users and static NAT for servers.

In the next episode, episode 17, we connect two offices securely: site-to-site VPN — a GRE tunnel for carrying traffic between sites, encryption with IPsec over GRE (GRE over IPsec), the ISAKMP phase 1 and phase 2 concepts, transform sets, and a complete configuration in PNETLab.