The Mapping

Public Port Key

The inbound reply hits the public NAT endpoint.

highlighted = computed this step

The public port is the reply key

The public NAT endpoint is 203.0.113.5 port 62000.

public port=62000\text{public port}=62000
Public port keyThe toy NAT table maps the public reply key back to the private endpoint.NAT reply mapping - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

Protocol is part of the match

The mapping is for protocol 17, the UDP value.

protocol=17\text{protocol}=17
Public port keyThe toy NAT table maps the public reply key back to the private endpoint.NAT reply mapping - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

The public key points inward

The public endpoint maps back to private port 40000.

private port=40000\text{private port}=40000
Public port keyThe toy NAT table maps the public reply key back to the private endpoint.NAT reply mapping - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination

Summary

The reply lookup starts from the public destination endpoint on the inbound tuple.

public port=62000\text{public port}=62000
Public port keyThe toy NAT table maps the public reply key back to the private endpoint.NAT reply mapping - 203.0.113.5:62000 maps to 192.168.1.10:40000serverpublic keyprivateprotomatchaction198.51.100.53:53203.0.113.5:62000192.168.1.10:40000UDPyesrestore destination