Network Address Translation (NAT)

After building an application, the next challenge is making it accessible to other users.

During development, services usually run locally:

localhost
    │
    ▼
Application

However, localhost (loopback interface) is only accessible from the same machine. To allow other devices on the Internet to access our services, we need to expose the application through a network interface that can be reached externally.

A common deployment scenario is:

User on Internet
    │
    ▼
Public Network
    │
    ▼
Router / Gateway (140.112.94.130)
    │
    ▼
Private Network
    │
    ▼
Application Server (192.168.50.1)

Network Address Translation (NAT) allows internal services to communicate externally by translating addresses between:

1. Private IP addresses used inside local networks
2. Public IP addresses used on the Internet

To deploy an application, we usually bind the service to 0.0.0.0, which means listening on all available IPv4 network interfaces (e.g., LAN interfaces, virtual interfaces, and external interfaces), allowing the service to be accessed from other machines.

Secure Routing

Note that 127.0.0.1 (loopback interface) is a special network address that only allows communication within the same machine. Since packets sent to 127.0.0.1 never leave the host, services bound to this address CANNOT be accessed from external machines. This behavior can be used as a security mechanism by limiting sensitive services, such as databases, to local access only.

Example

A backend service may listen on 0.0.0.0 to accept user requests, while the database only listens on 127.0.0.1, ensuring that users can only interact with the database through the backend-defined APIs rather than directly modifying database records.

Static NAT

Static NAT creates a fixed mapping between one private IP address and one public IP address. It is commonly used when an internal server needs to have a dedicated public IP.

Example

Private Server              Public Address
192.168.1.100    <----->    140.xxx.xxx.100

Communication:

Internet
    |
    |
140.xxx.xxx.100
    |
    |
192.168.1.100
Private Server

Characteristics

• One private IP maps to one public IP
• Bidirectional communication is possible
• Common for servers requiring a permanent public address

PAT (Port Address Translation)

PAT is the most common form of NAT in home and small networks. It allows many private devices to share a single public IP by translating both IP addresses and port numbers.

Example

Client A:
192.168.1.10:50000
        │
        ▼
140.xxx.xxx.xxx:60001


Client B:
192.168.1.20:50000
        │
        ▼
140.xxx.xxx.xxx:60002

The router maintains a translation table:

Public Address              Private Address
140.xxx.xxx.xxx:60001  <->  192.168.1.10:50000
140.xxx.xxx.xxx:60002  <->  192.168.1.20:50000

Characteristics

• One public IP can serve many internal devices
• Also called NAPT (Network Address Port Translation)
• Used by most home routers

SNAT (Source NAT)

SNAT modifies the source address of outgoing packets. It is mainly used for internal clients accessing external services.

Example

Before:

Source:
192.168.1.10:50000

Destination:
8.8.8.8:443

After SNAT:

Source:
140.xxx.xxx.xxx:50000

Destination:
8.8.8.8:443

Typical usage:

Private Network
      |
      |
     SNAT
      |
      |
   Internet

Characteristics

• Used for outbound connections
• Hides internal IP addresses from the Internet

---

DNAT (Destination NAT)

DNAT modifies the destination address of incoming packets. It is commonly used for exposing internal services to external users

Example

Router rule:

Public Address
140.xxx.xxx.xxx:443
        │
        ▼
Private Server
192.168.1.100:443

Communication

  Internet User
        │
        ▼
140.xxx.xxx.xxx:443
        |
       DNAT
        │
        ▼
192.168.1.100:443

Characteristics

• Used for inbound connections
• The foundation of port forwarding

NAT Summary

Type	Direction	Modified Field	Common Usage
Static NAT	Both	IP address	Dedicated public IP for a server
PAT	Outbound	Source IP + Port	Home routers sharing one public IP
SNAT	Outbound	Source address	Internal clients accessing Internet
DNAT	Inbound	Destination address	Port forwarding and exposing services

Development:

localhost:8000


Testing:

192.168.1.100:8000


Production:

0.0.0.0:8000

+

Reverse Proxy

+

DNS

+

TLS