🔄

NAT Deep Dive: Tables, Timeouts, and Hairpinning

Medium

Free preview · 2 of 5 steps

Inside the NAT: connection tracking

NAT is not just IP address rewriting. A NAT gateway maintains a connection tracking table — a state machine that tracks every active flow through it. Without this state, the gateway wouldn't know which internal host to forward reply packets to.

Linux's conntrack module (used in iptables/nftables NAT) tracks TCP states, UDP flows, and ICMP. Tuning timeouts incorrectly causes either memory exhaustion (too long) or broken connections (too short).

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step