Share one outside address with different ports
02Network Address Port Translation (NAPT) can distinguish multiple private endpoints using transport ports on one outside address.
Separate input: outside TCP port 40002 has no local row in this example. Do not invent an internal destination; router-local handling and configured static services are separate.
Source for this drawing: RFC 3022 · Read RFC section 2.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The mapping includes a protocol and port, not only an IP address.
- NAPT maps a local address and transport identifier to an outside address and identifier. For TCP/UDP the identifier is a port; ICMP queries use a query identifier.
- Two hosts may use the same local TCP port. The chosen allocator gives them distinct outside TCP ports so return traffic can find the intended local endpoint.
- TCP and UDP are separate protocol spaces. The worked allocator scans a tiny chosen pool of ports 40000 and 40001; those values and that allocation policy are not prescribed by RFC 3022.
- An outside input with no local mapping is not automatically delivered to a private host. Section 2.2 distinguishes traffic for the router itself and statically mapped services; the diagram does not claim every unsolicited packet is universally dropped.
- The bounded helper performs mapping lookup, not a complete filtering or firewall policy. RFC 3022 does not specify every later NAT mapping/filtering behavior.
Packet fields and table rows are different objects: the table is local state, while the packet carries the rewritten tuple. Port reuse, filtering, hairpinning, timeout policy and later UDP/TCP NAT behavior specifications are outside this original mapping model.
Read the RFC section ↗