Network Address Translation - NAT Explained
Вставка
- Опубліковано 7 лют 2025
- NAT network address translation is a process of mapping an IP address or IP port pair to another IP address or IP: port. You might be wondering what a software engineer like me doing making a video on a low level networking concept? I have good reasons for that. NAT was originally designed to solve the ipv4 limited IP addresses, but since been used for port forwarding and layer 4 load balancing through the virtual ip address such as Haproxy thats why I decided to make a video about NAT from a software engineer view. In this video we will explain how NAT works and we will explain its applications.
Download slides here payhip.com/b/u...
(Members get slides to all my content for free)
Stay Awesome!
Hussein
Thank you. I have a kind of disease that I have to be curious about any topic in programming. And now I found my cure: Hussein Nasser! Your videos have exactly this property of going deep into the subject
this is better than netflix
In fact it is better. Got bored of Netflix... and now watching this at 1:30am
Need to cancel my subscription 😛
It's NATflix.
@@giovanni-cx5fb Good one XD
@@elhakimdev
Thanks 😆
Just wanna say one thing Hussein, I really really appreciate the in-depth explanations. I've seen many videos on protocols that just barely scratch the surface and you're left with more questions than answers at the end. You instead go and explain every little detail, with an approach that makes sense.
Thank you. I'm becoming a better Software Engineer daily by watching the stuff you post and talk about.
I blame the youtube algorithm. I should have found this channel a long time ago.
Same
Your explanation style and in-depth explanation are pure gold. We don't need an explanation in 2 min videos. Your explanation helped me connect the loophole in concepts and make it crystal clear perfectly. Thank you. Very much appreciate your efforts.
This channel is pure gold!!
bro has a good time recording amazing explaining videos while being high
Great video! I love the way you explain things and I really enjoy your attitude . You make this fun! I watched a few other videos you have and I am a fan. Keep up the great work! Thanks
Thank you Keith, really appreciate your comment and compliment. I try to lighten up the mood on dry topics like this. I know it could also be distracting sometimes when I do it too much So Im trying to find the balance.
Thanks again! Cheers
Me too!
Hi Sir, I am new member and have recently subscribed to your channel. Your style of explaining is really very good, all your videos are very informative. Please do not think that you speak a lot, actually you are doing a great job by explaining the concepts in detail. Thanks for all your efforts.
Thank you Amol! So kind of you 🙏
this is how teaching should be....Just wow...!! how we get familier with networking so easily...
I hated networking, i withdrawn my computer network course in university. i hated the teacher as well who teach us networking. after listening and watching your videos on webRTC and NAT, now i am thinking networking is not that much bad👀.
BTW Thank you for such a great backend engineering content.
Thanks a lot for making this video. It cleared my gap in NAT.
Really This is one of the best videos, I have seen on NAT. Thank you for explaining the concept in such simple way.
I like how you talk about related knowledge. It's like connecting the dots. Learn so much from your videos. Thank you so much ~
Awesome explanation Hussein. I love your videos, they are so at the basics and clear the fundamentals
Thank you! Glad you liked it
Amazing job Hussein. Thanks for the best explanation!
Best explanation ever on UA-cam
On top of the great content.
I just want to say that your thumbnails are awesome!!
Sir it's fun to learn. Thanks you, such a great video.
It is fun indeed! Thanks for your comment 🙏
Thank you..one of the best channels
in love with your videos! Allahumma baarik ya akhi!
You talk alot, and that's the best thing XD. Explaining in so much detail, its like you are learning with us and discovering as we go.
Even though videos are long but its worth watching thanks keep it up
Usama Wizard thank you Usama
Man! You're awesome.
"Router says, you wanna go out but you're naked, let me put some clothes on you 😂"
WOW fun and learning at the same time great stuff dude keep it up
Routers do not have an IP address. The interfaces on the router have IP addresses. This is particular but very important.
I read (really sorry if you also mentioned it in the video and I missed it) that NAT functions at the network layer (layer 3). Port forwarding deals with ports which is a layer 4 concept. Want to know if this fact is ignored when implementing NAT? What's bothering me more is that router is also a layer 3 thing, ideally I would think it doesn't have enough tech physically built into it to work on anything beyond layer 3.
Sorry if this doesn't make sense, thanks!
It's so helpful. Thanks so much for your content
Thank you Kelbin!! 🙏 glad you like the content
Thank you for the content 🙏🙏
Legendary Video
Redirected her from your latest video about NAT Slipstreaming and I'd like to really thank you about the great effort you put in your content ❤️.
I just have one question, What if client A with prvt. IP 192.168.0.17 and client B with prvt. IP 192.168.0.18, both wants to access let's say a nodejs server on server with pub. IP 40.82.84.10:8080 (imaginary 😅), both of them happen to create the same random port on let's say 8992 but each of them sent different messages. How will NAT know which response to send to which MAC address. Does it store the MAC address of the sender as well ?
Fantastic question!!! The router in this case will detect that and rewrite a new port for the second host and when it comes back it will rewrite it to the original.
@@hnasr Oh got it ! Great thanks for your reply جزاك الله خيرا
@@hnasr hi there, so the number of translations, for the same nodejs server is limited by number of ports available.(2^16).
what if i want to get through more connections than 2^16
do we have something like port multiplexing here :D
Hi! Thank you so much for these videos! Very entertaining and informative! One question, what if two devices (within the same network) made a request to the same server, how would the router know whom to send the response to?
Sure thing! Each client will get a unique source port which the router will use to send back data
@@hnasr Thanks for clearing!
@@hnasr won't they have different local ip address apart from port ??
@@booleanboolean2984 yes
Great content sir, and also so much fun to follow .. Thank you .
Man !!! 13:28 You are hilarious. Great Video. Respect !!
Superb 🎉
This is your first video that I am finding a bit hard to understand
Great video! I think I understood the main concept. But I do have a doubt. What if there are multiple devices within a local network that's working on the same port (all devices working on port 8080 for example). How will the router make the NAT table in that case?
My answer to that is each device even though on the same local network has a unique Ip address. John Chandler, Damon Chandler, Maddy Chandler. all Chandler's but with unique names.
This is lovely XD
For consistency it should be said, that from the WAN-Port (44.11.5.17) to the host 44.12.1.9, it must be routed again.
You wouldn't believe how long I had to search for to get this answer.I didn't even know it was called NAT, I was just typing stuff like "how router knows my computer when it receives data". Anyway, one question, what if the client machine pings the same server from two different ports? How does the router handle that ? cuz it just saves client IP and port with the server IP and port so how does it distinguish between the two client ports?
Glad you found the content!
So lets unpack your example
client (ip address c) and server (ip address s)
Client want to connect to s:80
client creates a random port 1234
Router sees client want to go s:80 and creates a mapping on its public ip (lets call it r) with another port,, created a NAT entry as follows
c:1234 wants going to s:80 through r:9876
Now client want to connect to s:25
Client creates another random port c:1235 and router creates new entry as follows
C:1235 going to s:25 through r:9875
So it is always a unique mapping.
Ohhh so router creates a new port for every entry ? Because my question was c:1234 wants to go to s:80 and then c:5678 also wants s:80. so when s:80 responds the router needs to find the correct client and that was my doubt.
Thanks again for the such a good content, Here when we want to communicate to other server which is another network and which TLS request, who will take care of TCP handshake and who will validate that certificate given by server.
If 2 clients from the same subnet made the same request to the same server over the internet, when the server replies and the router receives the packet, will oit find that there are two entries in the NAT table that map to the same request? How does the router know to which client this response belongs to? Is NAT aware of the session ID?
Amazing content !!!!!!
so what you're saying is to communicate on the internet we don't need to send MAC addresses along with the data frame ? MAC is only needed on a local network right. Am i right Hussein ?
Does Load Balancer uses NAT only to keep track of where it should forward the response back by who made the request?
I have a question about IP addresses in same local network.
If I run a local server on my PC localhost:9090 with IP 192.168.0.111
Wy can't I connect to it from my smartphone in the same network by giving the address 192.168.0.111:9090
Assuming your phone is connected to the same WIFI network than you should unless the your computer does not allow inbound traffic? If it is windows enable port 9090 inbound windows firewall
@@hnasr
Ok, thanks It was firewall related.
I'm using Linux Mint on my PC.
I googled and did the following:
sudo ufw allow from any to any port 9090 proto tcp
sudo ufw status
Status: active
To Action From
-- ------ ----
9090/tcp ALLOW Anywhere
9090/tcp (v6) ALLOW Anywhere (v6)
Now it worked!
Thanks to give me advice!
But what if 2 machines on the same subnet send different requests to the same destination? How does the router know, where in its subnet, to send the received response back to?
i) Does it store extra information about those requests?
ii) Does it overwrite the the original sender's information in the stored info.?
iii) Does it send all the received responses from the destination to both the senders? (Doens't feel correct)
Just one question. When the router assigns a public ip address to a request is it unique? If yes, how does he checks if the IP address is unique and what if there are no IP address available for that instance?
i don't know i may be wrong in when you make a get request shouldn't it go from layer 7 to layer 1
4:19
it should be
source ip address | source port number |get| destination port number | destination ip address
I love the part where you said we can address aliens with ipv6.
Here in NAT, What if multiple request are been sent to same networks by different machines, how the response will be get back to the right machine using NAT table.
Good question!
each machine in the internal network will have a unique IP address internally but the same public IP address (the router)
The NAT table will have the internal port/IP address mapped to the public IP address with a random internal port..
It makes lot of sense cool
Say two clients in the same subnet send request to the same server app. The nat table is updated with two entries. Then the request reaches the target server. The server then replies back to receiver. In this case, the router should be confused to find out real receiver. and how the port forwarding will work now ?
What happens when multiple client nodes from the same subnet are reaching out to the external target node system?
They each get a unique source port to identify them
awesome...
Interesting thing, this NAT. One question about it: how the source machine picks random port? Believe, source machine should ensure the port is free. But how the machine knows the port is free on the router? I guess, it sends a simple request to get that port is free to router. But what if all router ports are busy? So the request should not be sent, right?
The machine keeps track of all its used source ports because it has a list of all active connections. Usually the operating system takes care of this ..
Good question
You are crazy but I do like your videos and way of expression :))
Mr Hussein , when you say that the source attaches the MAC address of the router to the packet, then does it mean that in the data link layer when it attaches the mac address of destination it attaches the mac address of router instead of final destination , if so then how does the packet reach the destination mac address if the destination mac address is not attached to the packet when it is launched from the router.
hey, what happens when the router stores in the memory 2 different private ips with the same ephemeral port and they both try to access the same server ip ?
in the NAT u give them diff ports for example one u give him : 8892 the other 8893
You can also forward other ip protocols like GRE…
Hey Hussein - Great video. Can you please share the slides?
Thanks Gurpreet! Let me do that I forgot to do so
Just posted it to the members community post :)
Is the third column in your NAT table required? Can the router not forward all inbound traffic coming on 44.11.5.17:8992 to 192.168.1.2:8992 ?
I enjoyed it more than 2min video xd
Mateusz Ciupa 😂😂 glad you did! Thanks for watching
I also enjoyed more than 2 min videos! It brings more explanation and connects everything together!
what happens when multiple clients sends a request to the same ip address. How does the router know which request should be forwarded back to which client?
a random source port will be assigned to both clients. those ports will be used to reroute packets back to each client.
e.g.
bot h 10.0.0.1 and 10.0.0.2 want to visit 8.8.8.8 : 80 , public router ip 1.2.3.4
router will have two entries
10.0.0.1 : 1111 -> 1.2.3.4: 1111 -> 8.8.8.8 : 80
10.0.0.2 : 2222 -> 1.2.3.4: 2222 -> 8.8.8.8: 80
wow another great video - thank you! question: so where does the modem fit into this picture?
Modem comes before the router. It is probably a layer 2 device and basically what it does is to convert from telephone signals to ethernet signals and vice versa
Hi, Hussein. Quick question. In your OSI video, you have the port numbers before the IP address in the packet structure and in this video, you have the reverse of that. I assumed that the port numbers get added before the IP addresses. Is this a mistake or I am wrong?
The way I present it is just for visualization and explanation purposes.
In reality, the IP packet header has the ip addresses and the TCP segment has the port.
How does packet flow between different subnets?
Could you please explain NAT type too . Thanks again 👍
What if there are two local machines sending packets to the same server, in that case, what would the router do because, when the response comes back from the server, now the router will be confused as to where to send it know??
Router will assign a unique source port for each machine so when the server reply to the router ip and port, the router will forward the packets back to the correct machine
@@hnasr now it makes sense..👍
Great video!
Isn't something similar happening when using docker? For example, if we want to containerize a nodejs app, we might instantiate the container with `-p 49160:8080`, so when going to the port of the host (49160), it will map to the private address of the container, which uses 8080. Is this correct?
Andrei Gătej that is very similar to iptables where it maps ports to internal virtual networks created by docker
Great content!
Alex Stoyanov thank you Alex!
If there are two device 192.168.1.2 and 192.168.1.3 and both request from the same port 8992 for the same address 44.12.1.9:8080 then in table there will be two row. But problem is when it received the package router don't know from which device that request came because there is data duplication, So will it sent package to both server or may be router will do second request on other port.
case 1: same port
-----------------------------------------------------------------------------------------------------
192.168.1.2:8892 | 44.11.5.17:8892 | 44.12.1.9.8080
-----------------------------------------------------------------------------------------------------
192.168.1.3:8892 | 44.11.5.17:8892 | 44.12.1.9.8080
-----------------------------------------------------------------------------------------------------
case 2: different port of router
-----------------------------------------------------------------------------------------------------
192.168.1.2:8892 | 44.11.5.17:8892 | 44.12.1.9.8080
-----------------------------------------------------------------------------------------------------
192.168.1.3:8892 | 44.11.5.17:8893 | 44.12.1.9.8080
-----------------------------------------------------------------------------------------------------
I think they implement second approach.
cool video
Even in L7 LB, the proxy has to remember the client in some way so that it can sends the response from the server back to the appropriate requested client. It can use this NAT for this or it can use some sort of mapping between TCP connections in proxy FE and proxy BE. Right?
so...nat is keeps track of those changes IP addresses in a table and change it accordingly on requests ?! 🤔🤔
Paras Arora correct, not requests though, packets
@@hnasr ohh yes yes ... thank u for clearing !! and great video sir 👌👌
i spend full day one the channel to get there, lol
one question here so who can use port 80 directly without port forwarding ?! only known web servers like Apache or gws ?!also the documentation said the gateway change the port to fit more connection to one private ip range ,using what called pat(port address translation ) in the transport layer (tcp) that called port overloading ,,
here is some resource
ua-cam.com/video/01ajHxPLxAw/v-deo.html
ua-cam.com/video/n0UqAXu_GAI/v-deo.html
www.freeccnastudyguide.com/study-guides/ccna/ch10/10-4-nat-overloading-aka-port-address-translation-pat/#:~:text=NAT%20Overloading%20or%20Port%20Address,access%20to%20all%20inside%20hosts.
I'll make sure to let the aliens know..they told me they're still using ipv4😂
What happens if a machine is not connected to a router for example maybe a phone?
how does the router know which machine to send the response back if two machines send a request to the same server?
honeyspoon short answer source ports..
Long answer
when machine A sends a request to Server S it will have source ip and source port those are used in the NAT table to map the response back.
E.g.
Router store this in NAT
A:123 connects to S on port 80
B:456 connects to S on port 80
If A sends a request S the router exchanges A IP with its own R, and source port 123 becomes another random port lets say 999, then when a response
R:999 - S:80
When server responds back to R:999
Router says which machine is on port 999 and was destined to S:80 .. that is machine A:123
@@hnasr Thanks, very clear
It's kinda a ridiculous question but I have to ask it :)
As far as my concern, the router is responsible for connecting different networks together and switch for local networks.
So, I think in this example it should be a switch, not a router doesn't it?
Mohamed Shaban a switch plays with Mac addresses at layer 2 while the router plays with ip addresses at layer 3 changes subnets
But yes my router plays both as a router and a switch
@@hnasr I know that bro. What I meant is that if it's a router why we are dealing with mac addresses in this stage
I edited my comment, my router acts both as a switch and router in some cases..
@@hnasr Thank you so much,
Hussein :)
14:22 two-three minutes videos are when u study exams at university🤣🤣. but if u work on a project U want a video to be longer as it can be and all words have a value of gold. maybe I should say Bitcoin.
i think i have eye problem
i'm sure this channel should have 1m subs not 100k so guess it's my problem
In what video you talk about subnet?
I don’t believe I discussed that hmm i do mention it here ua-cam.com/video/ECukPUUK_74/v-deo.html
And here
ua-cam.com/video/dh406O2v_1c/v-deo.html
what if two computers want to access the same public server?
ah the assigned port of the router will determine which packet go back to which pc
Correct the router will assign a different source port for each in the NAT table
@@hnasr am watching your webRTC video. 👍👍👍👍👍👍
❤❤❤❤❤❤❤❤❤❤❤❤❤❤
NOOOOOO! In the picture at ~3min I was telling myself "pls dont say router, pls dont say router" and then you said it :-( routers rout between networks. you meant a switch. sorry to be that guy...
CORRECT! The switch component in my router is what did the work at 3:00~ good catch ..
my router acts as a router and switch at the same time, routes traffic to outside network, and switches packets to the same network
@@hnasr Also at traslation time, the source port is not necessary the same after translation, because at some point, 2 hosts may have chosen the same source port.
@@hnasr Also, at 07:00, no need to do an ARP request, because the server has just received a packet with IP 1.2 inside a frame with MAC AAA.
Lol sounds like a grinder account had me laughin
can syou show this being done? something practical
Sure! Might consider it in another video, thanks for the tip!
I just posted a new video on how to do this check it out! ua-cam.com/video/uuWzk8U4dJE/v-deo.html
I think you pronounce get as git... (
the talk is more like listening to some cartoon channel.
Too much repetition. Actual topic starts at @12:00
Too much crap in between for NAT basics.