NAT Deep Dive: Address Translation Visualized

The scenario

Private-PC (192.168.1.10) runs a web server on port 80 and sits behind NAT-GW, whose public address is 203.0.113.1. Internet (203.0.113.50) is a web server on the public side; it knows only its own network, 203.0.113.0/24, and has no route to 192.168.1.0/24. NAT-GW has three rules. An SNAT rule rewrites the source of connections from 192.168.1.0/24 to 203.0.113.1 as they leave through ge1. A DNAT rule forwards port 8080 on the gateway to 192.168.1.10:80, changing the port as well as the address. A second DNAT rule forwards port 443 to 192.168.1.10:443, where nothing listens. In each trace, click the NAT-GW hops: the 'Changed' line shows exactly which fields were rewritten.

What you will work out

Understand exactly what SNAT, DNAT and connection tracking each do, by watching the addresses change and by removing one rule to see what depends on it.

Why this matters

Home routers, cloud NAT gateways, Docker's port publishing and Kubernetes Services are all built from these two rewrites plus connection tracking. When NAT misbehaves, the useful question is always 'which rewrite happened, where, and will the reply come back through the same device to be undone?' Being able to answer that from a trace is what separates guessing from debugging.

Running it

NAT Deep Dive: Address Translation Visualized opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.