NAT and routing.
How a packet from 10.0.0.5 reaches 1.1.1.1, and how the reply finds its way back. Six animated chapters on source NAT (masquerade), destination NAT (port forwarding), the connection-tracking table the router keeps in its head, and the routing-table lookups happening at every hop.
NAT and routing animated tutorial. Source NAT (masquerade) for outbound traffic, destination NAT (port forwarding) for inbound, connection tracking tables, routing-table lookups and the default route. Visualized with real IPs.A packet from your laptop reaches 1.1.1.1 even though no one outside your house has ever heard of your laptop's IP. The trick is two rewrites and a routing table.
- ·Comfortable with what an IP address looks like (e.g. 10.0.0.5)
- ·Helpful: the OSI/TCP-IP layers lesson — IP and TCP layers come up a lot
- ·Helpful: subnet basics (private vs public ranges)
Explain why source NAT exists, what conntrack remembers, what destination NAT is for, and how a routing table picks an outgoing interface.
pace: 10 minutes
The setup — private LAN behind a public IP
Your laptop sits on a private network (10.0.0.0/24). The router has two interfaces: an inside one (10.0.0.1, the default gateway) and an outside one with a public IP (203.0.113.42). The public internet has no idea your 10.0.0.5 exists — and that's the point. NAT and routing are how the router translates between these two worlds.
A NAT router is not a security boundary by design — it's an address-translation engine. The reason it's sort of secure by accident is that unsolicited inbound traffic has nowhere to go — without a conntrack entry for it, the router has no idea which inside host to deliver it to. DNAT is the explicit opt-in to inbound delivery.
$ip route$ip route get 1.1.1.1$ip route add default via 10.0.0.1$ip route add 10.1.0.0/24 via 10.0.0.2$ip -s link$ip addr$conntrack -L$conntrack -E$iptables -t nat -L -n -v$nft list ruleset$iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE$iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 10.0.0.10:8080$sysctl net.ipv4.ip_forward$echo 1 > /proc/sys/net/ipv4/ip_forward$traceroute 1.1.1.1$mtr 1.1.1.1Why does your home router rewrite the SOURCE address on outbound traffic?
What does a router need to remember so that a reply packet finds its way back to the correct inside host?
You want users on the internet to reach a web server you run at 10.0.0.10:8080. What's the move?
Two routes match a packet's destination: 10.0.0.0/8 via interface A and 10.0.0.0/24 via interface B. Which wins?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
Subnet calculator
Carve a CIDR block, figure out where the network and broadcast live, list usable host range — all the layer-3 prep work before any NAT or routing rule makes sense.
Read this lesson as text6 chapters · quiz answers
01The setup — private LAN behind a public IP
Your laptop sits on a private network (10.0.0.0/24). The router has two interfaces: an inside one (10.0.0.1, the default gateway) and an outside one with a public IP (203.0.113.42). The public internet has no idea your 10.0.0.5 exists — and that's the point. NAT and routing are how the router translates between these two worlds.
02Source NAT — your laptop talks to the world
Your laptop sends a packet from 10.0.0.5:54321 → 1.1.1.1:443. The router can't just forward that — 10.0.0.5 is a private address that no one on the internet would know how to reply to. So the router rewrites the SOURCE: source becomes 203.0.113.42:62000 (a free port the router picked). The packet leaves; from 1.1.1.1's perspective, the conversation is with the router's public IP. This is source NAT (SNAT), often called 'masquerade' on Linux.
03Connection tracking — remembering the rewrite
To undo the rewrite for reply traffic, the router stores a 'connection tracking' entry: original source 10.0.0.5:54321 was translated to 203.0.113.42:62000, talking to 1.1.1.1:443. When 1.1.1.1 replies to 203.0.113.42:62000, the router looks up the entry and rewrites the destination back to 10.0.0.5:54321 before forwarding it inside. Conntrack is what makes NAT bidirectional — and why your home router can stop working when the table fills up.
04Destination NAT — inbound port forwarding
What if you want the OUTSIDE world to reach a service INSIDE your network — say, a self-hosted web server on 10.0.0.10:8080? You add a destination NAT rule: any packet arriving at the router's 203.0.113.42:443 gets rewritten so the DESTINATION becomes 10.0.0.10:8080. The internal server sees a normal request; the outside client never learns 10.0.0.10 exists. This is DNAT (also called port forwarding).
05Routing table — pick the right next hop
Every host with more than one network needs a routing table. For each destination IP, the table answers: which interface to send it out, and which next-hop router to send it to. Linux picks the MOST SPECIFIC matching route. Anything that doesn't match a specific route hits the default route (0.0.0.0/0) — which, for your laptop, points at the home router as the gateway out.
06End-to-end — putting it all together
A packet from 10.0.0.5 to 1.1.1.1: your laptop checks its route table, picks the default gateway (10.0.0.1), and sends the frame to the router's MAC. The router does SNAT, picks its own default gateway (the ISP), and forwards. When the reply comes back, conntrack rewrites the destination back to 10.0.0.5 and the router forwards it onto the inside network. Same packet, three different IP-header tuples along the way.
Quiz — answers
- Why does your home router rewrite the SOURCE address on outbound traffic?
- →Because private addresses (10.x, 172.16.x, 192.168.x) are not routable on the public internet — the reply needs to come back to the router's public IP, which then translates it back.Source NAT (also called masquerade) lets many private hosts share one public IP. The router keeps a translation table (conntrack) so the reply traffic gets rewritten back to the correct internal address.
- What does a router need to remember so that a reply packet finds its way back to the correct inside host?
- →The connection-tracking entry: original src IP:port, translated src IP:port, destination IP:port — so the reverse direction can be rewritten correctly.Conntrack stores the whole 5-tuple of the translation. When the table fills (older home routers had limits in the low thousands), new connections start failing — symptoms include 'Can't load any page' even though existing tabs still work.
- You want users on the internet to reach a web server you run at 10.0.0.10:8080. What's the move?
- →Add a destination NAT (DNAT / port forwarding) rule on the router: packets to <public IP>:443 → 10.0.0.10:8080.DNAT (port forwarding) is the inbound counterpart to SNAT. The outside client sends to the router's public IP; the router rewrites the destination to the inside server's address and forwards.
- Two routes match a packet's destination: 10.0.0.0/8 via interface A and 10.0.0.0/24 via interface B. Which wins?
- →10.0.0.0/24 — the more specific route wins (longest prefix match).Longest prefix match is the rule. /24 is more specific (a smaller, narrower range) than /8, so it wins. The default route 0.0.0.0/0 is the LEAST specific, so it only matches if nothing else does.
keep going — these pair well with what you just learned.
What happens when you type a URL?
The most-asked interview question, animated. Five chapters: DNS → TCP → TLS → HTTP → Render. Step through each at your own pace.
OSI / TCP-IP layers
A packet wrapped layer-by-layer, then unwrapped on the other side. Watch headers stack and peel off — OSI 7 and TCP/IP 4 side by side.
DNS deep dive
Beyond the basics: recursive vs iterative, cache layers, TTLs, glue records, and what `dig +trace` actually shows.