Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to check where a firewall and NAT are running on a network?

For example I can find out my gateway, DHCP, NDS, WINS server by checking network connection details. I would like to know if there is a Firewall or NAT running between me and the internet also.

would traceroute/tracert show the IP address of any Firewalls and NATs on my network?

share|improve this question
If you do not have access to your gateway/firewall the only thing could be is fire up tcpdump and see if your source ip gets translated to something else on LAN (of fw/gateway device). – Danila Ladner Apr 25 '13 at 19:56
Network connection details is showing you things that your computer discovers on its own or has to know (for instance, your DNS servers are either set by the administrator or by DHCP). A firewall doesn't work that way, neither does NAT. However it is possible to detect them by trying things and seeing if it gets blocked/NATted/modified. – gparent Apr 25 '13 at 19:56

from a command prompt, type ipconfig /all (assuming windows). If your ip address looks like 10.something.something.something, or 172.25.something.something, or 192.168.something.something, then your are on a NAT network. Those IP addresses are non-routable and reserved for internal NAT networks.

You can get a simple map of your network using tracert, which shows you the number of hops from your machine to your destination. If you do something like "tracert", and see more than a couple of hops, then you can sort of tell where your network ends and external networks begin. Everything on your network will share the first few octets of your IP address, and if you have a firewall and a router you will see them as hops in the output. From there, you could do additional probing to determine other things about the machines by using something like nmap or similar.

share|improve this answer

Of course there is. I know of very few networks that use routable ip addresses internally and therefore don't use NAT. Here's how you can tell:

Run ipconfig or ifconfig on your computer and make note of the ip address. Then browse to a site like and make note of the ip address. Compare the two. If they're different than your computer is behind a NAT device.

share|improve this answer
ok so I can see that I am indeed behind a NAT device. now is there a way to get the NAT device's IP address? I don't think a NAT HAS to be my gateway does it? And how about finding my firewall's IP? – waspinator Apr 25 '13 at 20:06 – Danila Ladner Apr 25 '13 at 20:08
No it doesn't have to be the gateway, but it could be the gateway. Run a tracert to The device right before or right after the default gateway ip address is most likely the NAT device, if the default gateway itself is not the NAT device. – joeqwerty Apr 25 '13 at 20:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.