How many NAT mapping rules (that is, mappings between internal, private IP:PORT, and externally mapped IP:PORT) can a common NAT box support?

Is there a limit in such number (that is, how many rules can be 'active' at the same time) ?

  • 1
    Please be more specific about the "common NAT box". Hardware or software? If hardware: vendor/model; if software: OS, NAT product. Also, are we talking about the mappings that make up the state of a NAT, or some user-defined "port forwarding" kind of mapping?
    – earl
    Aug 24, 2009 at 11:39
  • I'm referring to both hardware and software nat, if there are differences. What is the 'average', considering both of the scenarios? I'm talking about the mappings currently part of the 'state' of the NAT, and not manually setup mappings. Aug 24, 2009 at 11:47

3 Answers 3


Two factors impact the maximum possible number of NAT mappings for a single device: the type of NAT and the amount of memory available for the NAT table:

  • As for the type of NAT, let's consider a full-cone NAT, to see how this affects the number of possible mappings: every internal ip:port pair is mapped to an external ip:port pair. Let's now assume that the NAT has only one external IP address available, the maximum number of possible mappings is limited by the possible number of external ports, which is 2^16.

  • As for the amount of memory available for the NAT table, we have to separate two distinct classes of NATs: "hardware" and "software" NATs. I consider purpose-built devices such as home routers or professional network equipment to be hardware NATs, whereas stock PCs running a general-purpose OS along with some NAT software makes a software NAT.

    Whereas software NATs are obviously limited by the amount of memory the host machine has, hardware NATs have memory for NAT mappings built-in, which is typically not expandable, unless you are dealing with carrier-grade equipment. The size of this fixed memory then forms the limit on how much NAT mappings can be held alive concurrently. For typical home-router devices, NAT table sizes are in the range of 2^10 to 2^14 entries.

I think that should give you a pretty good idea of the dimensions limiting NAT mappings in practice. Obviously there are various other factors along this dimension, like process size limits for user-space software NATs, or policies limiting the maximum number of mappings per single host, etc.

  • But if the NAT mapping list, ip_conntrack, is too large, searching over it can be noticeable, isn't it?
    – rfmoz
    Jan 9, 2020 at 16:19

NAT is just a mechanism, it doesn't define any limitations, and any such would be entirely implementation dependent. I doubt if anyone could even give a ballpark average as there are so many NAT implementations out there. This question doesn't really make sense.


Up to now, the best answer is in this web page: http://www.informit.com/articles/article.aspx?p=25273&seqNum=5 :

Theoretically, there is no limit on the number of mappings that the NAT table can hold. Practically, memory and CPU or the boundaries of the available addresses or ports place a limit on the number of entries. Each NAT mapping uses approximately 160 bytes of memory. In the rare case where the entries must be limited either for performance or policy reasons, you can use the ip nat translation max-entries command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.