Symmetric NAT

Symmetric NAT is a kind of network address translation where a router uses a different public port, and sometimes a different public IP address, for every destination a device talks to. It’s sometimes called hard NAT. Most home routers use friendlier kinds of NAT that keep the same public port for a device no matter where its traffic goes.

Why it blocks direct connections

To connect two hosts directly, Managed Nebula uses NAT traversal: each host’s public address and port is learned by a lighthouse and shared with the other host, and both send packets to each other’s address.

Behind symmetric NAT, the address and port the lighthouse saw only work for traffic to the lighthouse. When the host sends traffic to a peer, its router picks a new port, so the peer is sending to the wrong one and the packets never arrive. If only one side is behind symmetric NAT, a direct connection can sometimes still form. If both are, it usually can’t.

You’ll most often run into symmetric NAT with carrier-grade NAT on cellular networks (see CGNAT range), behind corporate firewalls, and with some cloud NAT gateways.

How Managed Nebula keeps hosts connected

When two hosts can’t connect directly, their traffic goes through a relay. By default every lighthouse on the network is also a relay, including the managed lighthouse, so hosts behind symmetric NAT stay connected with no extra setup. Relayed traffic is still end-to-end encrypted between the two hosts.

If many of your hosts sit behind symmetric NAT, or you’d rather keep relayed traffic on your own infrastructure, you can add dedicated relays close to them.