NAT first or Routing First ?

which will happen first for incoming and outgoing traffic in firewalls/routers ?

Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

NotLogicalConnect With a Mentor Commented:

That actually depends on where the traffic is flowing... Let's presume we are dealing with a small home router - like a DLink with 4 integrated switch ports. This applies to a Cisco PIX 501, too - as it has an integrated 4 port switch.

Take the following example:

- internal network is
- external network is everything else

In this scenario, if the switch fabric knows of the destination node by MAC and IP, the packet will go through the switch, and will not be seen by the router/firewall.

In this scenario, any destination addresses which are not known, will go through the router's routing table, and will most likely make it out through the NAT onto the "gateway of last resort" (or default gateway). Why "most likely"? Not all addresses are routable - some may get dropped.

A slightly different example:

- internal network #1 is
- internal network #2 is
- external network is everything else

In this scenario, I am presuming that the router has the two networks in its routing table. As such, any packets sourced on network #1 destined for network #2 will hit the router.

Now, if you have a packet on either network #1 or network #2 destined for somewhere else, the default gateway comes into play. At that point in time, the packet will traverse the NAT tables, and be sent out onto the internet...

In the reverse direction, an incoming packet from the outside world is first matched against a NAT/SPI rule, and then routed to the appropriate destination network (if applicable).

It is true that some firewalls have routing capabilities, and some routers can do simple NAT. However, I would not rely on a firewall to perform heavy-duty routing, or use a router to do enterprise-wide NAT.


They happen at the same time, in the same device, usually.  The router picks up the packet from one network, translates the address, send the packet down a new network.  If routing is moving the traffic from one network to another, and NAT is the translation of addreses/ports, then my crude explanation would suggest that the NAT part is happening right in between the start and end of the routing part.  But really, lets just say they're happening at the same time.

I suspect that you could benefit from a more detailed or targeted answer if you more specifically explained what you're looking for.  Have you got a network issue?  Are you just having a deep and meaningful conversation with your brother about the finer points of routing?
As above, but really, the answer "depends".

If you can give us an idea of what device you are using and also in what direction you are looking at.

Normally though, outbound traffic is checked to make sure it can route, then natted, then sent out the routed interface.
All Courses

From novice to tech pro — start learning today.