Build the idea first, then use the next activity to check it.
Translating outward, publishing inward
The difference between many hosts sharing one public address and one inside service being reachable from outside - and why the second needs a rule the first never does.
What you will be able to do
- Distinguish static NAT, pooled NAT and PAT by what each maps
- Explain why outbound sharing needs no inbound rule
- Describe what a port forward adds and where it is applied
Before this: You need "NAT and PAT" for the basic translation idea, and TCP/UDP ports, since PAT and port forwarding are both built on them.
Why it matters: Outbound NAT is invisible when it works, so the first time most engineers think about it is when something inside must be reachable from outside - a portal, a mail server, a monitoring endpoint. That is a different rule in a different direction, and confusing the two is the usual reason a published service stays unreachable.
Translation comes in a few shapes, and they differ in what maps to what. Getting the shape right is most of the work; the syntax follows from it.
| Kind | Mapping | Used for |
|---|---|---|
| Static NAT | One inside address to one outside address | A server that must always appear at the same public address |
| Pooled NAT | Many inside addresses to a pool of outside ones | More hosts than public addresses, but not many more |
| PAT (overload) | Many inside addresses to ONE outside address, separated by port | Almost every internet connection you have used |
Why outbound needs no inbound rule
When an inside host opens a connection outward, the router records the translation it made. The reply arrives addressed to the outside address and port, the router finds the matching entry, and rewrites it back. Nothing had to be configured for that specific reply, because the entry was created by the outbound packet itself.
Publishing a service inward
A port forward is that rule. It says traffic arriving at this outside address, on this port, should be rewritten to that inside address and port. It is applied on the way in, before routing decides where the packet goes.
A portal on 8080
The portal server sits at 10.20.30.10 and listens on 8080. The router's outside address is 198.51.100.7. A forward maps 198.51.100.7:8080 to 10.20.30.10:8080, and an external client connects to the public address as though the server were there.
- The forward must be applied on the interface traffic arrives on - applying it outbound does nothing.
- The inside host still needs a route back out, or the reply never returns.
- A firewall rule permitting the port is separate from the translation, and both are required.
Key takeaways
- Static NAT maps one to one, pooled NAT many to a few, PAT many to one using ports.
- Outbound translation builds its own return path; inbound has nothing to learn from and needs an explicit rule.
- A port forward is applied where traffic arrives, and needs a return route and a permitting firewall rule to work.
- Verify a published service by connecting to it, not by re-reading the configuration.
Ready to keep going?
Create a free account to save your progress and take the knowledge check.