NAT is a reality in the modern Internet and it is something we all have to deal with. Ideally it works perfectly and you never need to think about it. This page will help you in those other times.
What Network Address Translation (NAT) Does
When the Internet was conceived of in the 1970’s, the idea was to give every computer on it its own address – called an IP address. In the 1990’s the Internet exploded in popularity and it turned out there was a shortage of IP addresses. Since then the number of Internet enabled devices have grown dramatically, making the problem even worse. The solution is to give each location its own IP address and then to rely on the local router to use Network Address Translation to share this address among all of the local devices.
Why Network Address Translation Doesn’t Always Work
Most devices and people use the Internet in an “outgoing” capacity; the intention is to connect to a service such as Netflix or Zoom. In these situations pretty much all NAT works fine.
Complications arise when the user or device wants to handle “incoming” traffic. This can happen especially when using a peer-to-peer service such as a videogame or a VOIP telephone. In this situation two devices are trying to talk to each other directly and NAT is blocking the attempt.
The Gradients of NAT
There are many different types of NAT and generally each one reflects a trade-off between accessibility and security. The earliest NAT devices were very easy to work around but they also made it too easy for malicious 3rd parties to attack users and devices. Over time routers have improved their security but in doing so it has become more difficult for peer-to-peer applications to function.
If you think that you’re experiencing issues with your local NAT, the first step is to determine what kind of NAT it is. There are a few options here:
- See if your device/app has an option to detect the local NAT type. Nearly all modern videogame systems have this feature.
- Use an online service to quickly determine your NAT type. www.checkmynat.com and natchecker.com can give you this information almost instantly.
- Run NAT Connectivity Analyzer on your local computer.
The different types of NAT can generally be placed in the following buckets:
- Full Cone NAT: Communication is very easy with this NAT type – too easy. Most applications will work without difficulty but the users behind the NAT are unknowingly vulnerable to a variety of attacks. Most modern routers are moving away from this kind of NAT.
- Restricted Cone and Port Restricted Cone: These kind of NATs only allow outgoing connections. The problem is, what if both users sit behind these NATs, how do they both “place the call”? In order to support these types of NAT, the application must use a matchmaking service so that both sides create outgoing connections at the same time. It’s kludgy but after a few attempts it’s completely possible to create a connection.
- Symmetric: This NAT type makes peer-to-peer connectivity impossible. It is mainly used in business settings where it is important to keep tight control over how computers connect to each other. If you have a symmetric NAT, your best option is to enable automatic port forwarding (see below).
Another Option: Automatic Port Forwarding
Some routers have an option to forward incoming traffic automatically. This is usually named Automatic Port Forwarding but might instead be called UPnP, NAT-PMP, or PCP.
If you’re having trouble with your NAT, you can turn these features on and see if it solves your problem. Try running NAT Connectivity Analyzer, as it can not only detect if your router has these features enabled but it will test them and make sure they are working correctly. It will also tell you whether your router’s port forwarding is one way or two way, which may matter to the program that you’re running.
One word of caution: many computer security experts recommend keeping this feature turned off. UPnP in particular gained a bad reputation many years ago due to some poorly designed routers but modern routers do not have the same problems. The best advice here is to not enable it needlessly, but there is little harm in keeping it on if you need it.
A Common Complication: Double NAT
A double NAT occurs when one router with NAT is plugged into a second router with NAT. This generally happens in two scenarios:
- Your Internet Service Provider doesn’t have enough IP addresses and is using carrier-grade NAT (CGNAT) to share them among users.
- Your local network has too many routers.
There is not much you can do about the former scenario (other than switch to a different Internet Service Provider) but it is worth exploring the second scenario.
The easiest way to detect a double NAT is to turn on automatic port forwarding and then run NAT Connectivity Analyzer. It will try to open a port and if it detects a second NAT then it will let you know.
Double NATs are usually a minor nuisance and many users live with them just fine but if you’re having networking issues then it may be worth resolving. There are two approaches to getting rid of a double NAT:
- Move as many devices as possible from the inner NAT (usually a wireless router) to the outer NAT (usually a modem).
- Switch the outer NAT (usually a modem) into bridging mode and configure your inner NAT router to connect to the ISP directly. This is a good solution if you’ve purchased a router with significant features that the other router doesn’t have (such as VPN).
Conclusion
The Internet was originally designed so that any computer could talk directly to any other computer. The modern Internet has discarded this design somewhat, moving in favor of client devices that connect directly with large corporate services. Most routers today are built with this in mind and prioritize securing the local network against attackers over enabling peer-to-peer communication.
Peer-to-peer is still possible however and many exciting apps, games, and devices use this methodology. It is worth getting to the bottom of your local router’s NAT in order to unlock these abilities.