NAT: how address translation works and why inbound connections fail

What it is

RFC 3022 describes traditional NAT: a router with one or a few public addresses rewrites the source address (basic NAT) or source address and port (NAPT) of packets leaving a private network and records the mapping in a session table; replies matching the table are rewritten back and forwarded inward. The table entry is created by the first outbound packet. An inbound packet with no matching entry has no private destination to go to and is dropped. RFC 4787 classifies NAT behaviour: mapping behaviour (whether the same internal port gets the same external port for every destination, "Endpoint-Independent Mapping") and filtering behaviour (which external senders may use an existing mapping). It also requires UDP mappings to survive at least two minutes of idleness; RFC 5382 requires at least 2 hours 4 minutes for established TCP connections. RFC 6598 reserves 100.64.0.0/10 for carrier-grade NAT, a second translation inside the provider's network.

Why it matters

Every "the server cannot reach my machine" question is this mechanism. Webhooks, peer-to-peer calls, remote support and running a service at home all need an inbound path that the NAT does not create by itself. Idle mappings expiring explain long-lived connections that die overnight, and address-dependent filtering explains why a technique that works behind one router fails behind another.

How to apply

• For a service that must be reachable, create a static mapping (port forwarding) on the NAT, or use IPv6, which needs no translation, subject to the firewall.
• Behind a NAT that cannot be configured (carrier-grade, corporate, mobile), use an outbound connection to a relay: a reverse tunnel (ssh -R), a TURN server (RFC 8656) or a broker the service polls.
• For peer-to-peer traffic, use hole punching (RFC 5128 surveys the technique) with a fallback relay, because it depends on both NATs' mapping and filtering behaviour.
• Send keep-alive traffic more often than the shortest idle timeout in the path; devices that expire UDP mappings sooner than the RFC minimum are commonly reported, so measure rather than assume.

Pitfalls

A NAT that does not support hairpinning (RFC 4787) prevents two hosts on the same private network from reaching each other through the public address. Protocols that carry addresses in their payload (SIP, FTP) need application-level gateways or ICE-style negotiation. Double NAT breaks port forwarding on the inner router because the outer one has no mapping.