NAT

Most important commands to remember

• nft list ruleset — inspect configured translation and filtering rules.
• conntrack -L — inspect currently tracked flows.

Commands and flags

Command or option	Meaning
sudo nft list ruleset	Read the current nftables configuration with administrator privileges.
sudo conntrack -L -p tcp	List tracked TCP flows; -L means list and -p tcp selects TCP.

These commands inspect only this machine’s network namespace. They do not reveal NAT performed by a cloud platform or another router.

The concepts that matter

1. NAT rewrites addresses at a boundary

Network Address Translation (NAT) changes IP addresses and sometimes transport ports as packets cross a device. It lets the addresses seen on one side differ from those seen on the other.

For example, several private clients can share one outward-facing IPv4 address using different translated ports. The remote service sees the translated source, so its logs alone may not identify the original internal client.

2. Source and destination translation solve different problems

SNAT changes the source, commonly for outbound traffic. Masquerading is source NAT that derives the address from an outgoing interface. DNAT changes the destination, commonly to forward an incoming address and port toward an internal service.

Translation is not the same as routing: a translated packet still needs a route and permission to pass. A destination change can affect which route is selected; a route alone does not create a translation.

3. State connects both directions

With ordinary stateful NAT, the initial packet establishes a mapping recorded by connection tracking. Later packets use that mapping, and matching replies are translated back toward the original endpoint.

Mappings have a lifetime and consume resources. Idle expiry, port exhaustion, or losing translation state can disrupt otherwise healthy applications. UDP can be tracked too, even though it has no TCP-style handshake.

4. Translation is not a security policy

NAT changes addressing; a firewall decides what traffic is allowed. An outbound mapping can enable replies, but neither address hiding nor a mapping proves that application traffic is authorized or encrypted.

A useful investigation compares the original endpoints, translated endpoints, and return path. It must also locate where translation actually happens. On a VM, seeing no local NAT rule is compatible with an upstream gateway doing the translation.

One small example

Optional: inspect a Linux lab VM where you may view network configuration. No rules are added or removed.

sudo nft list ruleset
sudo conntrack -L -p tcp

In nft output, look for snat, dnat, or masquerade statements and the chains containing them. A rule shows intended behavior, not proof that a particular flow matched it. An empty ruleset can be valid.

Conntrack entries describe original and reply directions using repeated src, dst, sport, and dport fields. Compare the two endpoint pairs: translation may make them differ from a simple reversal. The timeout is a remaining lifetime in seconds; a TCP state is transport tracking, not application health.

No entries can mean no tracked matching traffic or no relevant local tracking. The command may also report unavailable kernel support. It does not establish that there is no NAT elsewhere. No cleanup is needed.

Keep this idea: NAT changes endpoint addresses; connection tracking remembers the mapping, and routing and filtering still apply.