IP routing and NAT: forwarding, translation, and state

Routing selects a next hop from destination reachability. NAT rewrites addresses or transport identifiers and maintains mapping state. They are often co-located, but they solve different problems and fail differently.

Mental model

• Forwarding uses the most specific matching destination prefix. The control plane learns or configures routes; the data plane applies the installed forwarding entry.
• BGP exchanges reachability and policy attributes between autonomous systems; it is not the per-packet forwarding algorithm.
• Traditional NAPT creates or reuses an address-and-port mapping for outbound traffic. Mapping behavior and filtering behavior are separate properties.
• NAT does not create end-to-end identity, encryption, or a general security boundary. IPv6 removes address scarcity pressure but still needs routing and security policy.

Гарантии и границы

• IPv4 routers decrement TTL when forwarding; expiration bounds loops and can generate ICMP Time Exceeded.
• A NAT return path requires applicable live state or explicit inbound configuration.
• CGN external ports are finite shared resources; exhaustion should reject new mappings instead of deleting established ones.
• Route availability is not application availability: the destination can be routed but unhealthy.

Сценарии диаграммы

Longest-prefix forwarding. The data plane chooses the most specific matching prefix from its installed forwarding entries.

Outbound NAT mapping and return traffic. An outbound packet creates or reuses translation state; permitted return traffic is translated through that state.

Mapping expiry and unsolicited inbound traffic. Translation mapping and filtering policy are distinct; expired or absent state cannot identify an internal endpoint.

TTL limits a forwarding loop. A router decrements IPv4 TTL while forwarding and discards a packet that reaches zero, normally returning ICMP Time Exceeded for unicast.

Архитектурные решения

• Separate route control, forwarding, translation, filtering, and application retry policies in diagrams and alerts.
• Prefer IPv6 where feasible; if CGN is required, budget port capacity, mapping churn, logs, privacy, and abuse correlation.
• For inbound reachability, specify an explicit mechanism rather than assuming NAT will discover the internal target.

Сбои и неоднозначные исходы

• A missing route and an expired NAT mapping can both look like a timeout but require different telemetry.
• Asymmetric paths are valid for routing but stateful NAT or firewalls must observe the required direction or share state.
• BGP convergence and policy can change the next hop; existing application sessions still need transport recovery.

Операционный checklist

• Show the destination prefix and selected next hop separately from translated source state.
• Budget external addresses, ports, mapping rate, and mapping lifetime.
• Log only the mapping data required by policy and protect it as sensitive operational data.
• Test expiry, port exhaustion, asymmetric return, and ICMP handling.

Связанная концепция

Первичные источники

1. https://www.rfc-editor.org/rfc/rfc1812.html
2. https://www.rfc-editor.org/rfc/rfc4632.html
3. https://www.rfc-editor.org/rfc/rfc3022.html
4. https://www.rfc-editor.org/rfc/rfc4787.html
5. https://www.rfc-editor.org/rfc/rfc6888.html
6. https://www.rfc-editor.org/rfc/rfc4271.html