Keep bindings and sessions separate
03A binding can serve several sessions. Losing translation state or releasing it too early can break replies.
Separate failover example: an alternate translator has the same outside address but no matching row. Configuration alone cannot recover the local endpoint; synchronized session state is needed.
Source for this drawing: RFC 3022 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The last session matters; ending one session need not remove a shared binding.
- Section 3.1 describes binding on the first outgoing session. Basic NAT binds an address; NAPT binds an address/transport tuple.
- Section 3.2 allows soft state for individual connections using a binding. Section 3.1 allows simultaneous sessions from the same local tuple to share a binding.
- Section 3.3 says the binding may be terminated when its last session ends. It does not prescribe a timeout value or require immediate release in every implementation.
- Section 1 requires requests and responses for a session to traverse the same translation state. Rerouting through another NAT can fail unless configuration and relevant state are shared.
- The helper has explicit begin/end events, no guessed TCP teardown or UDP timer. Repeating the same begin/end event is idempotent and must not delete another session.
The illustration chooses immediate release after the last explicit end event. That is an example policy, not a universal timeout or a complete connection tracker. An alternative retain-idle option in the helper demonstrates the publication’s may wording. No production networking state is created.
Read the RFC section ↗