Routing, NAT and gateways
How a router chooses a next hop, what a default route is, how NAT rewrites packets and what that breaks, and why traceroute shows fewer hops than there are routers.
Longest prefix wins
A router matches the destination against its forwarding table and picks the most specific route. Only if nothing matches does the default route, 0.0.0.0/0, apply.
ip route show
# default via 192.168.1.1 dev wlan0 proto dhcp metric 600
# 192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.10
# 10.8.0.0/24 via 192.168.1.1 dev wlan0
# 0.0.0.0/0 is the least specific possible route
ip route get 203.0.113.5
# 203.0.113.5 via 192.168.1.1 dev wlan0 src 192.168.1.10- The metric breaks ties between routes to the same prefix; lower wins.
- A host routes through its gateway for anything outside its own subnet.
- An asymmetric path, where the reply returns a different way, breaks stateful firewalls and many NAT setups.
- Route changes propagate by BGP between autonomous systems, and a more specific announcement can hijack traffic.
NAT rewrites and the things it breaks
inside NAT table outside
192.168.1.10:51001 <-> 203.0.113.5:443
rewritten to
198.51.100.7:40001 <-> 203.0.113.5:443
the reply arrives for 198.51.100.7:40001 and is rewritten back
to 192.168.1.10:51001 using the stored mapping| Breaks | Why | Workaround |
|---|---|---|
| Inbound connections | No mapping exists until inside initiates | Port forwarding, or a reverse tunnel |
| Protocols carrying addresses | The payload is not rewritten | Protocol-aware ALG, or a different design |
| Peer-to-peer | Both peers are behind NAT | STUN plus TURN relay |
| IPsec and some VPNs | Checksums or addresses are embedded | NAT traversal encapsulation |
| Source address logging | All users share an address | Log the port mapping with a timestamp |
| Rate limiting by IP | One abusive user affects everyone | Rate limit on a higher-signal key |
# inspect NAT mappings on a Linux gateway
conntrack -L | head
# tcp 6 431999 ESTABLISHED src=192.168.1.10 dst=203.0.113.5 sport=51001 dport=443
# src=203.0.113.5 dst=198.51.100.7 sport=443 dport=40001 [ASSURED]
sysctl net.netfilter.nf_conntrack_max
sysctl net.netfilter.nf_conntrack_countA conntrack table that fills up causes new connections to be dropped while established ones keep working — a failure mode that looks like a random outage because existing sessions are unaffected.
What traceroute reveals and hides
- Each hop is discovered by sending packets with an increasing TTL and reading the ICMP error that comes back.
- A hop showing
* * *is not necessarily broken; many routers are configured not to generate ICMP replies. - Load-balanced paths mean successive probes take different routes, so the hop list can be inconsistent between runs.
- MPLS tunnels and carrier NAT hide internal hops, so fewer hops appear than routers in the path.
- High latency on a middle hop that drops again is usually control-plane rate limiting, not a real bottleneck.
traceroute -n 203.0.113.5 # no reverse DNS lookups
traceroute -T -p 443 203.0.113.5 # TCP probes, often passes filter rules that drop ICMP
mtr -rwzc 20 203.0.113.5 # repeated samples with loss per hop
ss -tlnp # what is actually listening locally⚠️
Do not conclude a path is broken from a single traceroute run. Loss that appears at one hop and disappears at later hops is almost always ICMP rate limiting on that router, not a forwarding problem on the path.
FAQ
Does NAT provide security?
It blocks unsolicited inbound connections as a side effect, which is not the same as a firewall. Stateful inspection, explicit rules and logging are still required.
Why do two hosts behind the same NAT appear as one address?
The NAT rewrites the source address and tracks the mapping by port. Any remote service that rate limits on source address therefore treats every user behind that NAT as one client.
Related
IP addressing, CIDR and subnetting Network debugging toolkit
Last refreshed 2026-09-18.