What is NAT?
Network Address Translation
NAT (Network Address Translation) is rewriting the IP addresses of packets as they pass a router, most often so private hosts can share a public address.
Hosts on a home or office LAN usually have private addresses such as 10.0.0.10, which the internet has no route back to. With source NAT, the router replaces the private source address of outgoing packets with its own public address, for example 203.0.113.2, and usually the source port too, so thousands of connections can share one address (this many-to-one form is often called PAT or NAPT). The router's connection tracking table records each mapping, and when a reply arrives it reverses the translation and forwards the packet to the right inside host. Destination NAT does the opposite for incoming traffic: a port forward rewrites packets arriving at 203.0.113.2 port 8080 to 10.0.0.10 port 80, so an internal server can be reached from outside.
NAT is everywhere IPv4 is short of addresses, from home routers to carrier-grade NAT at ISPs, but it causes recurring confusion. It is not a firewall: it blocks unsolicited inbound connections only as a side effect, and a proper firewall policy is still needed. Missing NAT has a distinctive symptom: requests leave and reach the server, but replies addressed to a private address never come back. NAT also breaks protocols that embed addresses, and makes logs harder to tie to a single host. IPv6 normally does without it, because every host can have a globally routable address. See SNAT, DNAT and conntrack for the parts. The Setting up VyOS with NAT lesson builds source NAT and port forwarding, and Packets That Never Come Back diagnoses a missing NAT rule with tcpdump.
Lessons that use NAT
- Packets That Never Come BackTeaches this term · Intermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Setting up VyOS with NATBeginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- Zone-based firewall on VyOSIntermediate · 35 min
Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.
- IPv6 on VyOS: setup and routingBeginner · 55 min
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
- Site-to-site VPN with WireGuard on VyOSIntermediate · 35 min
Join two sites' private LANs across the internet with WireGuard on VyOS: keys and peers, the AllowedIPs mistake and what it teaches, what the internet actually sees, and the tunnel's smaller MTU.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.