Networking interview question · Most asked
How does NAT work, and what are its limits?
Summary
Source NAT rewrites a private source address and port to a public address and port, records the mapping, and reverses it for replies. Its limits: hosts behind it can't receive unsolicited inbound connections, and each public IP has a finite number of ports per destination, so many connections to one destination can exhaust it. Mappings also expire after an idle timeout.
Longer Answer
AWS NAT gateways support about 55,000 simultaneous connections per unique destination per IP and up to 8 IPs; ErrorPortAllocation shows exhaustion. Idle TCP connections are dropped after 350 seconds. Fixes include connection reuse, more NAT IPs, splitting traffic, or private connectivity.
Key Points
- Rewrites source IP/port; tracks mappings.
- No unsolicited inbound connections.
- Per-destination port limits.
- Idle timeouts drop long-idle connections.
Deep dive: Cloud Networking in Production: Timeouts to One Partner API
Explanation
What interviewers look for
Understanding port exhaustion and idle timeouts as real production issues.
Follow-up questions
- How would you detect NAT port exhaustion?
More most-asked Networking questions
- What's the difference between stateful and stateless firewalls? Give cloud examples.
- What's the difference between TCP and UDP, and when would you choose UDP?
- What do 502, 503 and 504 errors from a load balancer usually mean?
- What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
- How does DNS resolution work, and what does a record's TTL control?
- What does TLS provide, and how does certificate validation work?
- What happens, at the network level, when you type a URL into a browser and press Enter?
- A service is unreachable. How do you troubleshoot it systematically?