NAT

What is Network Address Translation (NAT)?

Network Address Translation (NAT) is a technique in which a Router or Firewall rewrites the IP addresses (and often the port numbers) in the headers of passing packets, so that devices in one network appear under a different address in another network. NAT was described in RFC 1631 in 1994 as a stopgap for the exhaustion of IPv4 addresses and has since become ubiquitous, from home routers to industrial firewalls. In OT networks, NAT is mainly used to connect machines with identical addresses to the plant network without changing the internal IP scheme.

NAT solves addressing problems, not security problems. The protection comes from the firewall rules that sit next to it.

🧠 How does NAT work?

A NAT device sits on the boundary between two networks and maintains a translation table. For every packet that crosses the boundary, the following happens:

1. Rewriting - the source or destination address (and, with port translation, the port number) is replaced by the translated address.
2. Updating checksums - the IP checksum and the TCP or UDP checksum are recalculated, otherwise the receiver discards the packet.
3. Remembering the mapping - the pair internal address/port ↔ external address/port is stored in the table, so that return traffic reaches the right internal device.
4. Expiring the mapping - after a period without traffic the entry is removed. RFC 4787 (2007) requires at least 2 minutes for UDP and recommends 5 minutes or more; RFC 5382 (2008) requires at least 2 hours and 4 minutes for an established TCP connection.

That last point matters in industry: a PLC that communicates over UDP only once every ten minutes can lose its mapping, after which replies no longer arrive.

🔄 What types of NAT are there?

The terminology is defined in RFC 2663 (1999) and RFC 3022 (2001). In practice you will encounter these variants:

With NAPT, hundreds of devices share one public address using different source ports; each address offers just over 64,000 ports. The private address ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 come from RFC 1918 (1996). Note that NAT is not needed for routing as such: it mainly solves the problem of private or overlapping addresses.

🏭 Why do OT networks use NAT?

• Identical machines - OEMs often ship their machines with the same default subnet, for example 192.168.1.0/24. With 1:1 NAT, each machine gets a unique address on the OT network while its internal configuration stays the same.
• No reprogramming - IP addresses are embedded in PLC programs, HMI projects and O configurations. Changing them costs engineering time and often retesting; NAT avoids that.
• Overlapping addresses after mergers - two plants that both use 10.0.0.0/8 can still exchange data through NAT.
• Connection to IT and the DMZ/IDMZ - the machine network stays hidden behind a limited number of translated addresses.
• Remote Access - a VPN gateway or jump server reaches exactly one PLC or HMI via DNAT without exposing the whole subnet.
• Outbound connections to the cloud - an edge gateway sends data via NAPT to a cloud service or MQTT broker. Because the connection starts from the inside, no inbound NAT rule is needed.

Rockwell Automation, for example, offers the 1783-NATR for this purpose, a router with 1:1 NAT for up to 32 translations. Industrial security routers from vendors such as Siemens (SCALANCE S) and Phoenix Contact (mGuard) also support NAT.

🔧 Which industrial protocols work well or poorly with NAT?

NAT only rewrites headers. Protocols that carry IP addresses inside their payload, or that do not use IP at all, therefore run into problems.

For protocols with addresses in the payload, such as FTP, Application Level Gateways (ALGs) exist that also rewrite the content. They are error-prone and rarely available for industrial protocols.

🔐 Is NAT a security control?

No. NAT hides internal addresses, and NAPT blocks unsolicited inbound traffic as a side effect, but that is not deliberate access control. Points to watch:

• Always combine with a stateful Firewall and explicit access control rules; otherwise a DNAT rule opens a direct path to a PLC.
• Zones and conduits - NAT fits within the zones and conduits model of IEC 62443, but does not replace the network segmentation required by IEC 62443-3-3.
• Visibility - after NAT, Logging, audits and network monitoring only see the translated address. Log the NAT table or place an IDS on the inside.
• Documentation - keep an up-to-date list of all mappings; forgotten port forwards are a well-known cause of HMIs that are unintentionally reachable.
• Defense in Depth - NAT is at most an extra layer and must not be regarded as a substitute for security.

🛠️ How do you set up NAT for a machine line?

A common approach when integrating identical OEM machines:

1. Inventory each machine’s internal subnet, the devices that must be reachable from outside and the protocols in use.
2. Choose an address block on the plant network for each machine, for example 10.20.11.0/24 for machine 1 and 10.20.12.0/24 for machine 2.
3. Configure 1:1 NAT only for the devices that actually communicate (PLC, HMI), not for the whole subnet.
4. Set firewall rules at port level, for example only TCP 4840 from the SCADA server to the PLC.
5. Check timeouts for UDP traffic and use keep-alives on connections with little traffic.
6. Test and document the mappings in the network design and include them in change management.

🔍 What are the benefits and limitations of NAT?

OPC UA and MQTT are far more NAT-friendly than older industrial protocols, because they use a single fixed port and can open the connection from the inside.

❓ Frequently asked questions

What is the difference between NAT and PAT?

Classic NAT translates only the IP address, often one to one. PAT (formally NAPT) also translates the port number, so that many internal devices can share a single external IP address.

Does NAT protect a PLC against attacks?

NAT hides the internal address of a PLC, but it is not deliberate access control. A PLC behind NAT is only protected when a stateful firewall permits just the necessary traffic and the NAT rules are properly managed.

Why does PROFINET not work through NAT?

PROFINET RT traffic runs directly over Ethernet at layer 2 and has no IP header that NAT could translate. NAT can therefore only translate the IP-based parts of a PROFINET installation, such as engineering or diagnostic traffic, between networks.

Does IPv6 still need NAT?

IPv6 has enough addresses to make NAT for address conservation unnecessary. IPv6 is still little used in OT, and variants such as NPTv6 and NAT64 exist mainly for transition scenarios and prefix independence.

When should you use 1:1 NAT in a plant?

1:1 NAT is the standard choice when several identical machines share the same internal IP scheme and must be reachable from the plant network. Each internal device then gets a fixed, unique external address while the machine configuration remains unchanged.

Why does a connection through NAT sometimes drop?

A NAT device removes a mapping after a period without traffic. For UDP that timeout is often only a few minutes, so infrequent messages can lose their mapping; keep-alives or a longer timeout solve this.

📌 In summary

Network Address Translation (NAT) translates IP addresses between networks and makes it possible to connect identical machines and overlapping address schemes between OT and IT. NAT is useful for remote access, network separation and IP management, but it is only secure in combination with firewall rules, segmentation and good documentation.