Address translation

NAT mapping and filtering

Also called symmetric NAT, cone NAT, endpoint-independent mapping, endpoint-dependent mapping, port preservation, carrier-grade NAT, CGNAT

Whether a NAT keeps one public port per inside port (friendly to peer-to-peer) or picks one per destination.

RFC 4787 describes NATs by two behaviours. Mapping: endpoint-independent (the same public port whatever the destination, what hole punching needs) or endpoint-dependent, the "symmetric NAT" of carriers and some corporate firewalls. Filtering: who may send in on a mapping, anyone or only those the inside has sent to. Linux MASQUERADE maps endpoint-independently and keeps the inside port when it is free; --random-fully makes it symmetric. In a lab file, routing.natMapping picks one.

See it on real machines

Learn it on real machines.