The Reply

Honesty Boundary

This is one toy reply-table lookup, not production gateway behavior.

highlighted = computed this step

What this lookup shows

This toy example checks one inbound UDP reply against one saved NAT mapping row.

mapping rows=1\text{mapping rows}=1
NAT reply honesty boundaryThe mapping row chooses the delivered private destination.NAT reply lookup - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

Checked values

The trust boundary recomputes the inbound tuple, delivered tuple, public port 62000, and private port 40000.

private port=40000\text{private port}=40000
NAT reply honesty boundaryThe mapping row chooses the delivered private destination.NAT reply lookup - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

What this does not model

NOTE: toy NAT reply-table lookup only; not connection tracking timeouts, multiple clients, port collisions, TCP NAT, firewall policy, checksum offload repair, hairpin NAT, IP version 6 translation, or production gateway behavior.

toy mapping rows=1\text{toy mapping rows}=1
NAT reply honesty boundaryThe mapping row chooses the delivered private destination.NAT reply lookup - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

Summary

The inbound public destination is mapped back to the saved private destination.

public port=62000\text{public port}=62000
NAT reply honesty boundaryThe mapping row chooses the delivered private destination.NAT reply lookup - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination