Routing and address translation (NAT)
Lesson 4 of 6
4Routing and address translation (NAT)
The big pictureNo device on earth knows the full road from your phone to a server in Japan. Each router knows one step: "for this destination, hand it to that one". And still the packet arrives in a fraction of a second, because every step is right.
What the picture shows: The packet hops from router to router. Each looks up the destination in its table and lowers the TTL by one, until a router directly connected to the server's network delivers it.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
A router is like motorway signs: at every junction a sign says "Riyadh right, Jeddah left, everything else straight on". No one carries the whole map, but every junction knows the next direction. NAT is like a company switchboard: staff have internal extensions, the world sees one number, and the switchboard remembers who called whom to put the answer through to the right person.
The decision in order: longest prefix match first (10.1.0.0/16 beats 10.0.0.0/8 for 10.1.5.9), then the lowest administrative distance among route sources (connected 0, static 1, eBGP 20, OSPF 110, RIP 120, iBGP 200), then the lowest metric within a protocol. 0.0.0.0/0 is the gateway of last resort. OSPF is link-state, builds a map and runs Dijkstra inside an organisation; BGP runs between autonomous systems by policy. PAT (NAT overload) shares a public address by port, and HSRP/VRRP give a standby virtual gateway.
Before You Start
🧮Subnets
You know prefixes and how an address matches one.
📦Ports
NAT relies on port numbers.
The Core Idea
1The routing table and the longest match
Every router holds a table: "for this network, send to this hop". When a packet arrives it compares the destination with every line, and more than one may match. The most specific wins, the one with the longest prefix, because it knows more about the destination.
This is how every router decides. Add a route and see who wins.
import ipaddress
routes = {
"0.0.0.0/0": "ISP",
"10.0.0.0/8": "R2",
"10.1.0.0/16": "R3",
"10.1.5.0/24": "R5",
}
def next_hop(destination):
ip = ipaddress.ip_address(destination)
matches = [ipaddress.ip_network(r) for r in routes if ip in ipaddress.ip_network(r)]
best = max(matches, key=lambda net: net.prefixlen)
return best, routes[str(best)]
for dest in ["10.1.5.9", "10.1.9.9", "10.200.0.1", "8.8.8.8"]:
net, hop = next_hop(dest)
print(f"{dest:<11} -> {str(net):<12} via {hop}")2Where routes come from
Three sources: networks directly connected to the router's interfaces, static routes an engineer types by hand, and dynamic routes learned by protocols. OSPF inside a company builds a full map and recalculates on its own when a link fails. BGP is the internet's protocol between large networks and chooses by policy and agreements, not by speed alone.
Read a line as: the code (S static, C connected, O OSPF), the prefix, [administrative distance/metric], the next hop and interface.
R1# show ip route Gateway of last resort is 203.0.113.1 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 203.0.113.1 C 10.1.1.0/24 is directly connected, Gi0/1 O 10.1.2.0/24 [110/2] via 10.1.12.2, Gi0/0 O 10.0.0.0/8 [110/20] via 10.1.12.2, Gi0/0 ! a default route and single-area OSPF R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 R1(config)# router ospf 1 R1(config-router)# router-id 1.1.1.1 R1(config-router)# network 10.1.0.0 0.0.255.255 area 0
| Route source (Cisco) | Administrative distance |
|---|---|
| Connected | 0 |
| Static | 1 |
| eBGP | 20 |
| OSPF | 110 |
| RIP | 120 |
| iBGP | 200 |
3NAT and PAT: a whole home on one address
Private addresses do not travel the internet. So when your device goes out, the router swaps the source address for the home's public one, changes the source port to a unique number, and records it in a table. When the reply comes back to that port, the table tells it which device it is for. That is PAT, and it runs in almost every home.
Note the last line: a reply matching no entry is dropped. That is why no one outside can start a connection to your device without "port forwarding".
public_ip = "198.51.100.7"
next_port = 40001
table = {} # public port -> (private ip, private port)
def go_out(src_ip, src_port):
global next_port
table[next_port] = (src_ip, src_port)
print(f"out: {src_ip}:{src_port} becomes {public_ip}:{next_port}")
next_port += 1
def come_back(dst_port):
inside = table.get(dst_port)
print(f"in: :{dst_port} ->", f"{inside[0]}:{inside[1]}" if inside else "no entry, dropped")
go_out("192.168.1.20", 51514)
go_out("192.168.1.31", 60022)
come_back(40001)
come_back(40002)
come_back(45000)Worked example
The task: a router has 0.0.0.0/0 via ISP, 172.16.0.0/12 via R2 and 172.16.8.0/22 via R3. Where do 172.16.9.4, 172.17.0.1 and 172.32.0.1 go? The answer: 172.16.9.4 falls in 172.16.8.0/22 (8.0 to 11.255) and in the /12, so the longer wins: R3. 172.17.0.1 is only in the /12: R2. 172.32.0.1 is outside the /12 (which ends at 172.31): the default route to the ISP.
Myth vs Reality
| Myth | Reality |
|---|---|
| A router knows the whole road to the destination. | It knows only the next hop and trusts the ones after. |
| The route with the lowest metric always wins. | Longest prefix first, then administrative distance, then metric. |
| IPv6 needs NAT like IPv4. | There are enough addresses for every device, so protection comes from the firewall, not translation. |
Where you meet it at work
🌐Providers
BGP joins their networks, and a mistake in it can take global services down.
🏠Home
"Port forwarding" adds a fixed NAT entry for a game server or a camera.
☁️Cloud
A NAT gateway lets private servers go out without accepting inbound connections.
Test your understanding
Which route is chosen for 10.1.5.9?
All but the last match, and the longest, /16, wins.
What is OSPF's default administrative distance on Cisco?
Static 1, EIGRP 90, OSPF 110, RIP 120.
How does PAT tell apart two devices behind one public address?
Each outgoing connection gets a unique public port in the table.
Which protocol connects autonomous systems on the internet?
OSPF inside an organisation, BGP between organisations.
What does TTL mean in an IP packet?
Each router lowers it by one so a packet never loops forever.
Quick review cards
Check Your Understanding
Why does every router lower the TTL?
So a packet cannot circle a routing loop forever; at zero it is dropped.
Why can a friend not reach a game server on your PC directly?
Because NAT does not know where to send an inbound connection with no table entry; port forwarding fixes it.
The difference between OSPF and BGP in one sentence?
OSPF finds the shortest path inside your network; BGP picks between the world's networks by policy.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Articles2
Done with this lesson?
Sign in to save your progress.