Stage 3 · Build
TCP/IP Fundamentals
Routing & NAT
Static routing, default gateways, NAT masquerade, and port forwarding.
Routing Tables
Every router and every host maintains a routing table — a lookup table that maps destination networks to next-hop addresses and outgoing interfaces. When a packet arrives, the kernel consults the routing table to decide where to send it.
# Linux
ip route show
# macOS
netstat -rn
# Example output
default via 10.0.0.1 dev eth0 proto dhcp metric 100
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.5
10.0.1.0/24 via 10.0.0.254 dev eth0The first line is the default route — packets for any destination not in the table go to 10.0.0.1. The second line is the directly connected network. The third line is a specific route to another subnet via a gateway.
Static Routing
Static routes are manually configured entries in the routing table. They are useful for small networks, VPN tunnels, and specific traffic paths that should not change.
# Add a route to 192.168.2.0/24 via gateway 10.0.0.254
sudo ip route add 192.168.2.0/24 via 10.0.0.254
# Add a route on a specific interface
sudo ip route add 172.16.0.0/16 via 10.0.0.254 dev eth1
# Delete a route
sudo ip route del 192.168.2.0/24
# Add a persistent route (survives reboot)
echo "192.168.2.0/24 via 10.0.0.254" | sudo tee /etc/sysconfig/network-scripts/route-eth0Static routes are fine for point-to-point links and small networks. For anything larger, dynamic routing protocols like OSPF or BGP are better because they adapt to link failures automatically.
Default Gateway
The default gateway is the router that handles all traffic not destined for a directly connected network. If your host does not know how to reach a destination, it sends the packet to the default gateway.
# Check current default gateway
ip route show default
# Set default gateway
sudo ip route add default via 10.0.0.1
# Remove default gateway
sudo ip route del default
# Check which interface the gateway is on
ip route get 8.8.8.8The ip route get command shows which route would be used for a specific destination. This is the most reliable way to verify routing.
NAT: Network Address Translation
NAT translates private (RFC 1918) addresses to public addresses and back. Without NAT, the 4.3 billion IPv4 addresses would have been exhausted decades ago. NAT lets millions of devices share a single public IP.
# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
# Masquerade outgoing traffic on eth0
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Allow forwarded traffic
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPTMASQUERADE is a form of Source NAT (SNAT) that replaces the source IP of outgoing packets with the router's public IP. The router tracks the mappings so return traffic is translated back.
SNAT changes the source address (outgoing traffic). DNAT changes the destination address (incoming traffic). Port forwarding is DNAT — it maps a public port to a private IP and port.
PAT and Masquerade
Port Address Translation (PAT) is the most common form of NAT. It maps multiple private IPs to a single public IP using different source ports. This is what your home router does — every device gets a unique source port on the public IP.
# Forward public port 8080 to internal server 10.0.0.10:80
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 10.0.0.10:80
# Forward port 2222 to internal SSH server
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination 10.0.0.20:22
# Allow the forwarded traffic
sudo iptables -A FORWARD -p tcp -d 10.0.0.10 --dport 80 -j ACCEPT
sudo iptables -A FORWARD -p tcp -d 10.0.0.20 --dport 22 -j ACCEPTDNAT redirects incoming connections to a different destination. The client connects to the public IP and port, and the router forwards it to the internal server. The client never sees the internal IP.
In AWS, GCP, and Azure, NAT is managed as a service (NAT Gateway, Cloud NAT). Do not run iptables NAT on EC2 instances for production traffic. Managed NAT gateways handle high availability, scale, and failover automatically.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.