NAT Subnet Planner

🌐 NAT Subnet Planner – Design and Document Your Network Address Translation Policies

Network Address Translation (NAT) is the cornerstone technology that allows organisations to connect private IPv4 networks to the public internet using a small pool of public IP addresses. This planner covers all three major NAT modes — Static NAT, Dynamic NAT, and PAT/Overload — and generates ready-to-paste Cisco IOS configuration snippets, structured JSON output, and full NAT translation tables.

Understanding the Three NAT Types

Static NAT (One-to-One)

Static NAT creates a permanent, bidirectional mapping between one private (inside local) IP address and one public (inside global) IP address. Because the mapping is fixed, inbound sessions initiated from the internet can reach the internal host — making Static NAT ideal for servers that must be publicly accessible, such as web servers, mail relays, and VPN concentrators.

Key formula: You need at least as many public IPs as usable private hosts. For a /24 inside subnet (254 usable hosts), you need 254 public IPs in your pool. If the public pool is smaller, the tool flags a pool exhaustion warning and shows how many hosts remain unserviced.

Dynamic NAT (Pool-Based)

Dynamic NAT maps private hosts to the next available IP from a finite public poolon demand. When all pool IPs are in use, additional translation attempts are dropped until a slot frees up. This mode works well when concurrent internet usage is predictable and lower than the total host count.

The oversubscription ratio (inside hosts ÷ public IPs) indicates demand pressure. A ratio of 5:1 means five private hosts compete for each public IP. Dynamic NAT tolerates moderate oversubscription if not all hosts are active simultaneously, but ratios above 10:1 risk frequent translation failures.

PAT / NAT Overload (Many-to-One)

Port Address Translation (PAT), also called NAT Overload, multiplexes thousands of private hosts behind a single public IP address by tagging each session with a unique source port number. The NAT device maintains a translation table mapping eachinsideLocalIP:port to publicIP:assignedPort.

Maximum simultaneous sessions equal the number of ports in the configured range. The standard ephemeral range 1024–65535 provides 64,512 ports per public IP — enough for most enterprise networks. The planner estimates sessions-per-host so you can verify your PAT pool can handle peak load.

RFC-1918 Private Address Ranges

RFC-1918 reserves three IPv4 blocks for private use that must never appear as source addresses on the public internet:

The planner warns you if you enter a non-RFC-1918 range as your inside network (unusual but valid for certain carrier-grade scenarios) or use a private range as your outside pool (which would indicate a double-NAT topology rather than direct internet access).

Key Metrics Explained

The planner generates five summary metrics at a glance:

• Inside Hosts — Usable host count in the inside subnet:2^(32 − prefix) − 2 (network and broadcast addresses are excluded).
• Public IPs — Usable IPs in the outside pool, calculated the same way for CIDR input or counted directly for a single IP.
• Oversubscription Ratio — insideHosts / publicIPs. Colour-coded green (≤1:1), amber (1:1–10:1), or red (>10:1).
• PAT Max Sessions — portEnd − portStart + 1; the total port capacity of the PAT translation table.
• Sessions per Host — patSessions / insideHosts; estimated port budget available per device.

Cisco IOS Configuration Output

Switch to the Cisco IOS output tab to generate a ready-to-paste configuration block for Cisco routers and ASA firewalls. The snippet includes interface NAT direction statements (ip nat inside / ip nat outside), extended ACL definitions, pool declarations, and source translation commands — tailored to your selected NAT type. Customise the interface names, pool name, and ACL name using the optional label fields before calculating.

Typical Workflow

1. Select the NAT type appropriate to your design (PAT for internet access, Static for servers).
2. Enter the inside subnet in CIDR notation (e.g., 192.168.1.0/24).
3. Enter the public IP or CIDR pool allocated by your ISP (e.g., 203.0.113.0/28).
4. Optionally fill in interface labels, pool name, and ACL name for config generation.
5. Click Calculate to view the summary, translation table, and config snippet.
6. Copy the Cisco IOS snippet directly into your change-management ticket or router terminal.