RFC 3022 / START HERE
Traditional NAT, before the details
NAT means Network Address Translation. RFC 3022 describes traditional IPv4 NAT: a router keeps mappings between private endpoints and outside addresses. Basic NAT changes an address; Network Address Port Translation (NAPT) also changes a transport port or query identifier.
A translator rewrites an outgoing source tuple, keeps state, and reverses the corresponding destination fields on a reply. It also repairs affected checksums. A mapping table lives in the translator; it is not an extra tunnel header. Translation does not encrypt data or authenticate a sender.
Why it exists
This January 2001 Informational publication explains how private networks can communicate using outside addresses and how several hosts can share one address with NAPT. It formally obsoletes RFC 1631 and corrects its checksum adjustment algorithm. RFC Editor metadata lists no formal updates to RFC 3022; later UDP NAT behavior guidance is labeled separately in the chapters.
A familiar example
Imagine two fictional laptops, 10.0.0.10 and 10.0.0.11, both contacting a server from TCP port 3017. A chosen NAPT mapping uses one outside address with different outside ports so replies reach the right laptop. The guide also shows shared bindings, checksum repairs, ICMP error quotes and application/fragmentation limits. Outside addresses in the drawings are documentation stand-ins, and the examples are not a complete current NAT implementation.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Translate an address in both directionsBasic Network Address Translation (NAT) maps a private IPv4 address to an outside address, then reverses that mapping for return traffic.→
- Share one outside address with different portsNetwork Address Port Translation (NAPT) can distinguish multiple private endpoints using transport ports on one outside address.→
- Keep bindings and sessions separateA binding can serve several sessions. Losing translation state or releasing it too early can break replies.→
- Repair the checksums that cover changed bytesAddress and port changes affect different checksum coverage. A pseudo-header includes IP addresses in TCP/UDP checksum calculations.→
- Translate the packet quoted inside an ICMP errorAn Internet Control Message Protocol (ICMP) error contains part of the packet that triggered it. Rewriting only the outer address is insufficient.→
- Recognize application and fragmentation boundariesA packet header rewrite cannot by itself repair every address embedded in an application or distinguish every fragmented datagram.→
This introduction explains RFC 3022 (2001). Read the original RFC ↗