How many valid NAT mappings can a common NAT support?

Question

How many NAT mapping rules (that is, mappings between internal, private IP:PORT, and externally mapped IP:PORT) can a common NAT box support?

Is there a limit in such number (that is, how many rules can be 'active' at the same time) ?

Answer 1

Two factors impact the maximum possible number of NAT mappings for a single device: the type of NAT and the amount of memory available for the NAT table:

• As for the type of NAT, let's consider a full-cone NAT, to see how this affects the number of possible mappings: every internal ip:port pair is mapped to an external ip:port pair. Let's now assume that the NAT has only one external IP address available, the maximum number of possible mappings is limited by the possible number of external ports, which is 2^16.

• As for the amount of memory available for the NAT table, we have to separate two distinct classes of NATs: "hardware" and "software" NATs. I consider purpose-built devices such as home routers or professional network equipment to be hardware NATs, whereas stock PCs running a general-purpose OS along with some NAT software makes a software NAT.

  Whereas software NATs are obviously limited by the amount of memory the host machine has, hardware NATs have memory for NAT mappings built-in, which is typically not expandable, unless you are dealing with carrier-grade equipment. The size of this fixed memory then forms the limit on how much NAT mappings can be held alive concurrently. For typical home-router devices, NAT table sizes are in the range of 2^10 to 2^14 entries.

I think that should give you a pretty good idea of the dimensions limiting NAT mappings in practice. Obviously there are various other factors along this dimension, like process size limits for user-space software NATs, or policies limiting the maximum number of mappings per single host, etc.

Answer 2

NAT is just a mechanism, it doesn't define any limitations, and any such would be entirely implementation dependent. I doubt if anyone could even give a ballpark average as there are so many NAT implementations out there. This question doesn't really make sense.

Answer 3

Up to now, the best answer is in this web page: http://www.informit.com/articles/article.aspx?p=25273&seqNum=5 :

Theoretically, there is no limit on the number of mappings that the NAT table can hold. Practically, memory and CPU or the boundaries of the available addresses or ports place a limit on the number of entries. Each NAT mapping uses approximately 160 bytes of memory. In the rare case where the entries must be limited either for performance or policy reasons, you can use the ip nat translation max-entries command.