1. IP Addressing: IPv4, Subnets, Public and Private IPs
1.8 NAT (Network Address Translation)
Class madhe students vichartat: "Sir, majha laptop 192.168.1.5 dakhavto pan website la vegla IP disto, kasa?" Uttar – NAT. Samjla ka? Chala baghu.
Why: Hundreds of devices on a institute network use private IPs, but the institute may have only a few public IPs. NAT lets many private devices share one public IP.
How: The router rewrites the source address of outgoing packets from the private IP to its public IP and keeps a translation table so replies go back to the correct device. The variant that also changes ports (many-to-one) is called PAT or NAT overload.
Private LAN (192.168.1.0/24) Internet
+------------------+
| Laptop | src 192.168.1.10:50001
| 192.168.1.10 |------+
+------------------+ | +-------------------+ src 198.51.100.7:61001
+----->| NAT Router |-----------------------> google.com
+------------------+ | | Public 198.51.100.7|<-----------------------
| Phone |------+ +-------------------+ reply to 198.51.100.7:61001
| 192.168.1.11 | NAT table:
+------------------+ 192.168.1.10:50001 <-> 198.51.100.7:61001
| NAT type | Mapping | Example |
|---|---|---|
| Static NAT | 1 private ↔ 1 public (fixed) | EC2 public IP / Elastic IP mapping |
| Dynamic NAT | private ↔ one from a pool of public IPs | Enterprise routers |
| PAT / NAT overload | many private → 1 public using ports | Home Wi-Fi, AWS NAT Gateway |
Why this matters for security
NAT hides internal addresses and, by default, blocks unsolicited inbound connections – helpful, but it is not a firewall policy. For investigations it matters a lot: many users behind one public IP means a single IP in a log may represent a whole office. On AWS, a NAT Gateway lets private servers download updates without being reachable from the internet.
Ravindra Bagale's Tip
Don't mistake NAT for a firewall. Many students say "I have NAT, so I'm safe" – but if you set up port forwarding, or malware gets inside, NAT stops nothing. NAT only changes addresses; for security you need firewall rules and security groups.
Ravindra Bagale's Tip – मराठी
NAT ला firewall समजू नका. बरेच students म्हणतात "NAT आहे म्हणजे मी safe" – पण port forwarding केलं, किंवा आत malware आला, तर NAT काहीच थांबवत नाही. NAT फक्त address बदलतो; security साठी firewall rules आणि security groups लागतात.
Ravindra Bagale's Tip – हिंदी
NAT को firewall मत समझो. बहुत से students कहते हैं "NAT है तो मैं safe हूँ" – पर port forwarding किया, या अंदर malware आ गया, तो NAT कुछ नहीं रोकता. NAT सिर्फ़ address बदलता है; security के लिए firewall rules और security groups चाहिए.
Lab
On any Linux machine run ip -4 addr, hostname -I and curl -s https://checkip.amazonaws.com. Explain in two lines why the two IPs are different.
Thodkyaat sangaycha tar
- IP = network location of a host; IPv4 = 32 bits in four octets; subnet mask splits network and host parts.
- Classes A/B/C/D/E are historical;
127.0.0.0/8is loopback. CIDR/ngives 2^(32−n) addresses. - Subnetting = segmentation; first and last address of a subnet are reserved (AWS reserves 5).
- DHCP gives dynamic addresses (DORA); servers need static addresses (Elastic IP on AWS).
- Private ranges (RFC 1918): 10/8, 172.16/12, 192.168/16. NAT lets many private hosts share one public IP – but NAT is not a firewall.
Samjla ka? Nasel tar punha vacha – aani `/32` vs `/0` cha farak kunalahi samjavun sanga. Aata pudhe jaauya: ports aani protocols.