NAT & PAT Lab | KaliRange

🎯 Lab Objectives

Understand why NAT exists and how it conserves IPv4 addresses
Configure Static NAT for 1-to-1 IP mapping
Configure Dynamic NAT with an IP address pool
Configure PAT so many private IPs share one public IP
Verify NAT translations and troubleshoot common issues

👶

NAT in plain English: Your home router has one public IP but many devices. NAT lets all those devices share that one IP — it keeps track of who sent what and delivers replies to the right device. PAT does this using port numbers to tell them apart.

Step 1 — NAT Overview

NAT Type	Mapping	Use Case
Static NAT	1 private IP → 1 public IP (permanent)	Servers that need consistent public IPs
Dynamic NAT	Pool of private IPs → pool of public IPs	Temporary, first-come-first-served
PAT / NAT Overload	Many private IPs → 1 public IP (uses ports)	Home/office internet (most common)

# NAT terminology:
# Inside Local    → private IP of internal device (e.g. 192.168.1.10)
# Inside Global   → public IP seen by internet (e.g. 203.0.113.5)
# Outside Local   → IP of external host as seen from inside
# Outside Global  → actual IP of external host

# Inside vs Outside interfaces:
# Inside  → connected to internal network (LAN side)
# Outside → connected to internet (WAN side)

Step 2 — Static NAT

# Mark interfaces as inside/outside
interface GigabitEthernet0/0
 ip nat inside

interface GigabitEthernet0/1
 ip nat outside

# Create static mapping: private → public
ip nat inside source static 192.168.1.10 203.0.113.10
ip nat inside source static 192.168.1.20 203.0.113.20

# Now:
# 192.168.1.10 always appears as 203.0.113.10 on the internet
# Inbound traffic to 203.0.113.10 → forwarded to 192.168.1.10

Step 3 — Dynamic NAT

# Mark interfaces
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

# Define a pool of public IPs
ip nat pool PUBLIC_POOL 203.0.113.1 203.0.113.10 netmask 255.255.255.0

# Create ACL to define which private IPs get translated
access-list 1 permit 192.168.1.0 0.0.0.255

# Link ACL to pool
ip nat inside source list 1 pool PUBLIC_POOL

# First 10 internal hosts get IPs from the pool
# 11th host gets NO translation (pool exhausted)
# This is why PAT is preferred

Step 4 — PAT (NAT Overload)

# PAT = Port Address Translation = NAT Overload
# Many internal IPs share ONE public IP, differentiated by port numbers
# This is what your home router does

# Method 1: Use the outside interface IP (most common)
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface GigabitEthernet0/1 overload
# "overload" keyword = PAT

# Method 2: Use a pool with overload
ip nat pool PAT_POOL 203.0.113.1 203.0.113.1 netmask 255.255.255.0
ip nat inside source list 1 pool PAT_POOL overload

Step 5 — Verify NAT

# Show NAT translation table
show ip nat translations

# Output example:
Pro  Inside global     Inside local      Outside local     Outside global
tcp  203.0.113.1:1024  192.168.1.10:1024 8.8.8.8:80       8.8.8.8:80
tcp  203.0.113.1:1025  192.168.1.20:3389 10.0.0.5:3389    10.0.0.5:3389

# Show NAT statistics
show ip nat statistics

# Clear the NAT translation table
clear ip nat translation *

# Debug NAT in real-time
debug ip nat
# Shows each translation as it happens
# NAT: s=192.168.1.10->203.0.113.1, d=8.8.8.8 [80]
undebug all

Step 6 — Port Forwarding (Static PAT)

# Forward specific port to internal server
# External port 80 → internal web server 192.168.1.100:80
ip nat inside source static tcp 192.168.1.100 80 203.0.113.1 80

# Forward RDP port
ip nat inside source static tcp 192.168.1.200 3389 203.0.113.1 3389

# Forward a different external port (security through obscurity)
# External port 2222 → internal SSH server port 22
ip nat inside source static tcp 192.168.1.100 22 203.0.113.1 2222

Step 7 — Troubleshooting NAT

# Issue: No translations in table
# Check:
# 1. Is ip nat inside set on the LAN interface?
# 2. Is ip nat outside set on the WAN interface?
# 3. Does the ACL match the source IP?
# 4. Is there a route to the internet from the router?

# Test: ping from an inside host to an outside IP
ping 8.8.8.8 source 192.168.1.1

# Check ACL matches
show access-lists 1

# Check routing table has a default route
show ip route | include 0.0.0.0

📋 NAT/PAT Cheat Sheet

Type	Configuration
Inside interface	`ip nat inside`
Outside interface	`ip nat outside`
Static NAT	`ip nat inside source static 192.168.1.1 203.0.113.1`
PAT (interface)	`ip nat inside source list 1 interface Gi0/1 overload`
Port forward	`ip nat inside source static tcp 192.168.1.1 80 203.0.113.1 80`
Verify	`show ip nat translations`
Clear table	`clear ip nat translation *`
Debug	`debug ip nat`

✅

Lab Complete! PAT is in use on essentially every home and office router on the planet. Understanding it is fundamental to networking.

Sign into track progress and send feedback.