Study Guide
IP forwarding, default gateways and NAT/PAT
Follow local frames and remote IP packets, then trace two private clients through a shared public-facing address.
Lesson 3.11 Networking Fundamentals
A switch connects devices within one network. This lesson is about everything else: how a device decides where to send traffic for another network, what a router does with it, and how many private devices can share one public address.
Stage: Think
Leaving the building
Think it through
A letter for a neighbour in your street can be handed over directly. A letter for another country cannot. What do you do with it, and do you need to know its whole route?
- Hint 1: Who decides the route a posted letter takes?
Show what happens
You post it and let the postal service handle the rest. You need to know only where the post box is, not the route. Devices treat traffic for other networks in the same way.
Think it through
Show the answer
Answer: C. It notes which connection was whose.
It keeps a note of each outgoing connection, so each reply can be matched to the device that made it. The second half of the lesson builds that note.
Stage: Explain
Two networks need a router
Picture two PCs on different networks with a router between them. The Subnetting lesson shows why they are on different networks: 10.1.16.1/24 is in 10.1.16.0 and 10.1.15.8/24 is in 10.1.15.0.
PC1 and PC2 have different network addresses, so traffic between them must be routed.
Network 10.1.16.0/24
PC110.1.16.1/24
Network 10.1.15.0/24
PC210.1.15.8/24
The router has one interface in each network. Each PC sends traffic for the other network to the router, which forwards it.
The difference in one line: a switch connects devices within a network, and a router connects different networks.
Stage: Explain
The example network
| Role | Address |
|---|---|
| Laptop A | 192.168.1.10/24 |
| Tablet B | 192.168.1.11/24 |
| Local printer | 192.168.1.20/24 |
| Router LAN / default gateway | 192.168.1.1/24 |
| Router public-facing address | 203.0.113.5 (documentation only) |
| Remote HTTPS server | 198.51.100.20:443 (documentation only) |
This is a home network, used for the rest of the lesson. The laptop’s MAC address is 02:00:00:00:00:10 and the router’s MAC address on the home side is 02:00:00:00:00:01. The home router does three separate jobs here: it routes between the home network and the internet provider’s network, it translates addresses, and it filters traffic as a firewall. One box often does all three, but they are different functions, and this lesson keeps them apart.
Stage: Predict
Choose local delivery or a next hop
Every device has to make one decision about everything it sends: is the destination on my own network, or somewhere else?
- If it is on my own network, deliver it directly.
- If it is anywhere else, hand it to the router and let the router work out the rest.
That router is the device’s default gateway: the way out of the local network, like the one door of a building that leads to the street. A device does not need to know the route to a distant server. It only needs to know where the door is. The next device a packet is handed to is called its next hop.
The device keeps these rules in a small routing table: a list of destinations and where to send traffic for each. A simplified laptop routing table is:
| Destination prefix | Delivery |
|---|---|
192.168.1.0/24 | Directly connected local interface |
0.0.0.0/0 | Via 192.168.1.1 |
Read the two lines as “anything in 192.168.1.0/24 is on my own network” and “everything else (0.0.0.0/0 means any address) goes to 192.168.1.1”. The second line is the default route.
Think it through
Using the two-line table, where does the laptop send a packet for 192.168.1.20, and where one for 198.51.100.20?
- Hint 1: Which line does each address fall inside?
Show what happens
The packet for 192.168.1.20 falls inside 192.168.1.0/24, so it is delivered directly. The one for 198.51.100.20 matches only the default route, so it goes to 192.168.1.1. Both cases are worked below.
Two destinations show the decision being made.
- The printer,
192.168.1.20. It falls inside192.168.1.0/24, so the first line matches. The laptop delivers directly, using the printer’s MAC address. - The web server,
198.51.100.20. It is not inside192.168.1.0/24, so the first line does not match. Only the default route does, so the laptop hands the packet to the gateway at192.168.1.1.
Think it through
Show the answer
Answer: A. The more specific line wins.
When more than one line matches, the more specific one wins: /24 is more specific than /0.
When more than one line matches, the more specific one wins, which is why the printer is not sent to the gateway even though “everything” includes it.
Stage: Predict
Reading a router’s routing table
Routers keep a routing table too, usually much larger. On a VyOS router, the show ip route command prints it. This table comes from a lab VyOS router:
Think it through
In the table below, some lines start with C and one with S. Before reading the explanation, which do you think are networks the router is plugged into, and which was entered by a person?
- Hint 1: Look at which lines say “directly connected”.
Show what happens
The C lines are connected networks, the ones the router has an interface in; S is a static route an administrator entered. The callout reads every line.
S 0.0.0.0/0 [1/0] via 10.1.128.1 inactive
C>* 10.1.16.0/24 is directly connected, eth1
C>* 10.1.24.0/24 is directly connected, eth2
C>* 10.1.254.254/32 is directly connected, lo
C>* 127.0.0.0/8 is directly connected, loClines are connected routes. The router has an interface directly in 10.1.16.0/24 (eth1) and 10.1.24.0/24 (eth2), so it can forward between those two networks without help.lois the loopback interface.10.1.254.254/32is a single-address route and127.0.0.0/8is the standard loopback range.Sis a static route, entered by an administrator.0.0.0.0/0is the default route, pointing to 10.1.128.1.>and*mark the selected route and a route installed for forwarding. The default route has neither and is marked inactive, so it was not being used.- What the table does not show: that traffic actually flowed anywhere beyond the connected networks. An inactive default route means destinations outside 10.1.16.0/24 and 10.1.24.0/24 had no working path in this state.
The table’s second network, 10.1.24.0/24, is a different network from the 10.1.15.0/24 in the two-PC example; they are separate illustrations.
Check your understanding
Show the answer
Answer: B. Yes: both are directly connected.
Yes. Both networks are directly connected, so the router can forward between them without the default route.
Stage: Predict
From the laptop to the gateway
Assume the laptop opens a TCP connection to the remote HTTPS server using source port 51542. If necessary, it uses ARP to resolve 192.168.1.1 to the gateway’s MAC.
Think it through
The laptop is about to send to 198.51.100.20 through its gateway. Predict the destination hardware address of the frame, and the destination IP address of the packet inside it.
- Hint 1: Which device must receive the frame first?
- Hint 2: Where is the packet finally going?
Show what happens
The frame is addressed to the gateway’s hardware address, 02:00:00:00:00:01; the packet inside still carries the server’s IP address, 198.51.100.20. The table shows every field.
| Field leaving the laptop | Value | Purpose |
|---|---|---|
| Ethernet source MAC | 02:00:00:00:00:10 | Sender on this local link |
| Ethernet destination MAC | 02:00:00:00:00:01 | Deliver the frame to the gateway |
| IP source | 192.168.1.10 | Originating private interface |
| IP destination | 198.51.100.20 | Remote server being contacted |
| TCP source / destination ports | 51542 / 443 | Client and server transport endpoints |
Three steps for this routed Ethernet example, one at a time. Routing and source translation have distinct purposes.
The laptop
Step 1 of 3: A local frame for the gateway
The frame targets the gateway’s MAC address. Inside it, the packet still targets 198.51.100.20, not the gateway’s IP address.
The gateway
Step 2 of 3: Route the packet
It processes the incoming frame and consults its routing table for the packet’s destination. Ordinary IP forwarding does not replace the destination with the next hop’s IP address.
The gateway
Step 3 of 3: A new frame for the next link
It uses the outgoing link’s delivery mechanism; on Ethernet, it builds a new frame for the next hop. The source translation described in the next step changes the source endpoint while keeping this example’s server destination.
The gateway’s MAC address matters only for this first step. It gets the frame across the home network and is then discarded. Each router on the way reads the IP packet, consults its own routing table and builds a new frame for the next link. The destination IP address stays the same throughout.
Go deeper What a router changes in a packet
Ordinary routing leaves the addresses in a packet alone, but it does change one field. Every IP packet carries a number called the TTL (time to live), and each router reduces it by one. A packet whose TTL reaches zero is thrown away, which stops a packet that is caught in a loop from circulating for ever.
Changing the addresses is a different function, address translation, described next. In this example it changes the source address and port, never the server’s destination address.
Stage: Predict
Two clients sharing one public-facing address
The home has one public address, 203.0.113.5, and several devices with private addresses that the internet will not carry. Something has to stand between them.
Think of an office with one public telephone number and a receptionist. When someone inside makes an outside call, the person called sees only the office’s number. The receptionist keeps a note: “line 1 is Asha at extension 12; line 2 is Ben at extension 15”. When an answer comes back on line 2, the note says to put it through to Ben.
- NAT (Network Address Translation) is the receptionist replacing the inside address with the office’s public one.
- PAT (Port Address Translation, also called NAT overload) is the note of which line belongs to whom. The “lines” are port numbers, and they are what let many devices share one address.
Think it through
Laptop A and tablet B both contact the same server, and both happen to choose source port 51542. If the router replaced only the address, what would go wrong?
- Hint 1: What would the two replies have in common?
Show what happens
The server’s two replies would look identical: the same address and the same port. Something else has to tell them apart, as the next paragraph shows.
Now the awkward case. Laptop A and tablet B both contact the same server, and both happen to choose the same source port, 51542. If the router changed only the address, the server’s two replies would be indistinguishable. So the router gives each connection its own outside port: 40001 for the laptop and 40002 for the tablet. (The numbers are examples; a router picks whatever is free.)
Simplified translation table
| Transport | Private source endpoint | Translated source endpoint | Remote endpoint |
|---|---|---|---|
| TCP | 192.168.1.10:51542 | 203.0.113.5:40001 | 198.51.100.20:443 |
| TCP | 192.168.1.11:51542 | 203.0.113.5:40002 | 198.51.100.20:443 |
Simplified TCP PAT mappings to the same example server, 198.51.100.20:443. Public-facing addresses shown are documentation-only examples.
- Device A · outbound192.168.1.10:51542 → 203.0.113.5:40001
The router translates A’s source address and port. Destination remains 198.51.100.20:443.
- Device B · outbound192.168.1.11:51542 → 203.0.113.5:40002
A different translated source port distinguishes B’s connection.
- Return traffic · reverse mappings40001 → Device A · 40002 → Device B
Replies to 203.0.113.5 use the corresponding translation mapping to reach each device at its original port 51542.
Translation state includes the transport protocol and relevant connection information. NAT/PAT translates traffic; firewall policy controls whether traffic is allowed.
The server sees two connections from the same address, 203.0.113.5, told apart by their ports. It never sees a private address.
Check your understanding
Show the answer
Answer: B. 192.168.1.11:51542 (tablet B).
To 192.168.1.11:51542, tablet B: the table pairs outside port 40002 with that private endpoint.
Follow one response home
- The server replies from
198.51.100.20:443to203.0.113.5:40001. - The router looks up port 40001 in its translation table and finds the laptop. It rewrites the destination to
192.168.1.10:51542. - If its firewall rules allow the traffic, it sends the packet onto the home network in a frame addressed to the laptop’s MAC address.
- The laptop matches the reply to the connection it opened and passes the data to the browser.
A reply arriving on port 40002 is sent to tablet B at 192.168.1.11:51542 in the same way. The router is not guessing which device spoke last: the table tells it. That is the receptionist’s note doing its job.
Go deeper What a real translation table also records
A real entry also records the transport protocol (TCP or UDP) and details of the connection, and entries are removed when a connection ends or goes quiet. A reply that arrives after its entry has gone cannot be delivered. Exactly how entries are matched varies between products. The traditional NAT specification describes address-and-port translation under the name NAPT (network address port translation).
Stage: Explain
NAT types and limits
PAT is common in home IPv4 networks, but NAT is not a firewall. Translation changes addressing; firewall policy decides which traffic is allowed. A device may implement both. Port forwarding deliberately maps selected inbound traffic towards an internal service, demonstrating why translation alone should not be treated as a security policy.
Some internet service providers (ISPs) translate addresses a second time on their own equipment, called Carrier-Grade NAT, so a home router may not have a public IPv4 address of its own. The one-router example in this lesson leaves that extra stage out. IPv6 normally does not require NAT for ordinary global connectivity; appropriate firewall controls remain important. These distinctions support Defence in Depth, where controls serve complementary purposes.
When a device can reach local printers but not the internet, check its default gateway first: missing or wrong, it explains exactly that symptom. When it can reach nothing beyond one subnet, look at the routing table on the device, and then on the router.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: A. Its default gateway setting.
Its default gateway. Local delivery works, so the address and mask are fine; a missing or wrong gateway explains exactly this symptom.
Apply it
Show the answer
Answer: B. The connected 192.168.6.0/24 route.
The connected 192.168.6.0/24 route: it matches, and it is more specific than the default.
Apply it
Show the answer
Answer: A. They cannot be delivered.
They cannot be delivered: without the entries, the router cannot tell which private device each reply belongs to. The phones must open new connections.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Use the more specific matching route; the default applies when none is more specific.
The default route is the fallback when no more specific route exists. Local traffic can normally be delivered directly. A default gateway is not selected by an ordinary DNS answer and is not necessarily used for every packet.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: Create distinct translated source-port mappings.
PAT can assign different translated source ports and use its mappings for returning traffic. MAC addresses are not public IPs; identical translated connections would not distinguish these clients. Firewall filtering is separate from translation.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: False
False. NAT changes addressing; firewall policy controls permitted traffic. Translation is not a substitute for a firewall, even though both functions often exist on the same home router.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: The MAC address of the router’s interface on PC1’s network, because PC2 is on a different network.
PC2 is on 10.1.15.0/24, not PC1’s 10.1.16.0/24, so PC1 sends the packet towards its default gateway and uses ARP to resolve the MAC address of the router’s interface on its own network, not PC2’s. The ARP request asks for that router’s own IPv4 address, not a network address, and every link still carries the packet inside a frame. No router interface address or ping result is assumed here.
Revision sources: Study Buddy — 23 September 2026 (Study Buddy session (supplementary)) · Session 5: Networking Fundamentals — Part 1 (Classroom session record) · IP forwarding, default gateways and NAT/PAT (Supplementary Study Guide explanation)
Show answer
Answer: The destination IP stays 10.1.15.8, while each link uses a new frame: first to the router, then to PC2.
A routed packet keeps its destination IP address, here 10.1.15.8, while the frame belongs to one link. PC1’s frame is addressed to the router’s MAC; the router builds a new frame on PC2’s network, addressed to PC2’s MAC. The sender resolves only its next hop’s MAC. Without NAT nothing rewrites the destination IP address, and a MAC address is only meaningful on its own link.
Revision sources: Study Buddy — 23 September 2026 (Study Buddy session (supplementary)) · Session 5: Networking Fundamentals — Part 1 (Classroom session record) · IP forwarding, default gateways and NAT/PAT (Supplementary Study Guide explanation)
Show answer
Answer: It has no active route for 198.51.100.7, so it cannot forward it using that default route.
The default route, 0.0.0.0/0, applies only when nothing more specific matches, and a route marked inactive is listed but not in use. Nothing more specific matches 198.51.100.7, and the default route that would have caught it is inactive, so the table offers no usable route. The order of entries does not choose a route, and a router does not try every interface in turn. Why the route is inactive cannot be told from the table alone.
Revision sources: IP forwarding, default gateways and NAT/PAT (Supplementary Study Guide explanation)
Study and revision
Use IPv4 and IPv6 Addresses and Subnetting for the addressing foundations, and Networking & Protocols revision for gateway, PAT, next-hop and routing-table questions. The next-hop questions use the 23 September two-PC drawing without assuming router addresses or a working network. The questions are learning-only.
Stage: Consolidate
What to remember
- A switch connects devices within a network; a router connects networks.
- A device delivers directly to its own network and sends everything else to its default gateway; the most specific matching route wins.
- Router tables show connected (C) and static (S) routes; an inactive default route means no path beyond the connected networks.
- Routing rebuilds the frame for each link but keeps the destination IP address.
- PAT gives each connection its own outside port, so many devices share one public address; NAT is not a firewall.
Key terms
- Router
A device that forwards traffic between networks, for example between a private local network and the internet.
- Default gateway
The next-hop router a device uses when no more specific route to a destination exists.
- Routing table
A device’s list of destination networks and how to reach each one: through a directly connected interface or via a next-hop router.
- Default route
The route 0.0.0.0/0, which matches any IPv4 destination that has no more specific route. It points to the default gateway.
- NAT (Network Address Translation)
Translating IP addresses as traffic passes a device, commonly so that devices with private addresses can use a public-facing address.
- PAT (Port Address Translation)
NAT that also maps port numbers, so many private devices can share one public-facing address.
Common misunderstandings
It is used only when no more specific route matches. Local traffic goes directly, and a more specific route wins over the default.
Ordinary routing keeps the destination IP address; only the frame is rebuilt for each link. Address changes come from NAT, a separate function.
NAT changes addresses; firewall policy decides which traffic is allowed. A device may do both, but they are different controls.
Lesson sources and acknowledgements
Sources and scope
This worked home-network scenario develops the additional explanations from my Session 5 ChatGPT note-taking discussion alongside the approved Learning Log. It is educational, not an observed network, tutor quotation or completed lab. Private addresses and locally administered MAC addresses are illustrative; external addresses use documentation-only ranges.
The reference’s two-client example is retained here with the addresses and ports used by the existing PAT diagram, so the table, diagram and return path tell the same story.
- Taught in Session 5 (see the Session 5 Learning Log): gateways and default gateways, local versus remote delivery, NAT with PAT, NAT types, and NAT not being a firewall.
- From the Study Buddy session on 23 September (see the entry): the PC1 and PC2 two-network drawing, and the instructor’s VyOS
show ip routedemonstration. Router interface addresses were not recorded, no ping result was shown, and the cause of the firewall configuration errors was not established. - Supplementary explanation: the door and reception-desk comparisons, the two-destination walk through the laptop’s routing table, the route-code explanations, the “Go deeper” notes, the misunderstandings and the practical note.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the letter and shared-address opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
The next-hop router a device uses when no more specific route to a destination exists.
The route 0.0.0.0/0, which matches any IPv4 destination that has no more specific route. It points to the default gateway.
A device at the end of a network connection that people or programs actually use: a laptop, desktop computer, phone, tablet or server.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
A control that allows or blocks network traffic according to configured rules.
An entry in a firewall policy that combines conditions, such as source, destination, protocol and port, with an action: allow or deny.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
A network covering a local area such as a home, office or building. Network scopes are general descriptions, not fixed distance limits.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
Translating IP addresses as traffic passes a device, commonly so that devices with private addresses can use a public-facing address.
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
NAT that also maps port numbers, so many private devices can share one public-facing address.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
A device that forwards traffic between networks, for example between a private local network and the internet.
A device’s list of destination networks and how to reach each one: through a directly connected interface or via a next-hop router.
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A connection-oriented transport protocol that starts connections with a SYN, SYN-ACK, ACK handshake and provides reliable, ordered delivery.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.