Foundations — NAT traversal, VPN, tunneling

Before you can follow the parent note, you need a picture for every word it throws at you. This page builds each one from absolute zero, in an order where each idea only uses ideas already defined.

1. What is an IP address? (the house number)

Why does the topic need it? Every trick in the parent note (NAT, tunneling, VPN) is about rewriting or wrapping these house numbers. If you don't picture the number as a delivery address, none of the rewriting makes sense.

See Private IP addressing for the exact reserved ranges.

Look at the figure: many houses share ONE public mailbox on the street. That single shared mailbox is exactly why NAT (Section 3) must exist — there aren't enough public numbers to go around (IPv4 exhaustion).

2. What is a port? (the room inside the house)

Why does the topic need it? NAT doesn't just rewrite the house number — it rewrites the port too, and its whole "translation table" is a list of IP:port pairs. STUN's entire job is to tell you "which public room number did the NAT give you?"

3. What is a packet? (the envelope)

Look at the figure: the header (orange) is the label routers read; the payload (teal) is the sealed contents they never open. This one picture is the whole topic in miniature — tunneling (Section 6) works precisely because routers only read the outer label and treat everything inside as opaque contents.

4. What is a router? (the post office)

Why does the topic need it? The key sentence of the whole parent note is "routers only read the outer header." That is not a coincidence — it is the definition of what a router does. Because it ignores the payload, you can hide a whole second envelope in there (tunneling) and the router happily carries it.

5. What is NAT? (the shared front desk)

Now we can define the star of the topic using only words already built.

Look at the figure — it is a hotel front desk:

• Inside guest 192.168.1.5:51000 (private, from Section 1) hands out a letter.
• The desk (NAT) crosses out the guest's room and writes its own public address 203.0.113.9:40000, then records the swap in a table.
• When a reply arrives for :40000, the desk looks up the table and forwards it back to room 51000.

See NAT for the full behaviour, and Firewalls / Port forwarding for how you deliberately punch a permanent hole.

6. What is encapsulation? (envelope inside an envelope)

The parent note writes this as:

$\text{TunnelPacket}=\underset{\text{new delivery label}}{\underbrace{H_{\text{outer}}}}\Vert \underset{\text{the original packet, now just contents}}{\underbrace{[H_{\text{inner}}\Vert \text{payload}]}}$

Two symbols to earn here:

• $\Vert$ means concatenation — "stick these bytes next to each other, in this order." It is not multiplication; it is gluing. $A\Vert B$ = the bytes of $A$ immediately followed by the bytes of $B$.
• $H$ just stands for header. $H_{\text{outer}}$ = the new outside label; $H_{\text{inner}}$ = the original label, now sealed inside where routers won't read it.

Why does the topic need it? Because a private 10.x address (Section 1) is meaningless on the public Internet — but if you wrap that packet inside an outer envelope addressed to a real public IP, every router (Section 4) reads only the outer label and delivers it. At the far end the wrapper is peeled off and the original emerges intact. That is tunneling, 6in4, and the mechanical heart of a VPN.

7. What is MTU? (the biggest envelope the mailbox accepts)

8. What does "encrypted" mean here? (the sealed, tamper-proof envelope)

Why does the topic need both? A plain tunnel (Section 6) hides nothing — anyone reading the wire sees the inner envelope. A VPN adds encryption (outsiders can't read) and authentication (outsiders can't forge letters into the tunnel):

$\text{VPN}=\text{Encapsulation}+\text{Encryption}+\text{Authentication}$

You'll meet the real machinery in IPsec, TLS, and WireGuard; WebRTC uses the NAT-traversal half.

Prerequisite map

Follow the arrows back to the parent: the full topic sits at the bottom, fed by every foundation above.

Equipment checklist