While some ISPs may grumble a bit about the idea of many computers sharing a single "Internet account", they are also relieved, since each ISP has a limited allocation of customer IPs. Therefore, as home and office networks grow in size, NAT routers are ISP-friendly.

A few important bits of terminology we are about to need:

A NAT Router's Inherent Security
Although NAT routers are not generally purchased for their security benefits, all NAT routers inherently function as very effective hardware firewalls (with a few caveats examined below). As a hardware firewall they prevent "unsolicited", unexpected, unwanted, and potentially annoying or dangerous traffic from the public Internet from passing through the router and entering the user's private LAN network.

The reason they do this is very simple: With multiple "internal" computers on the LAN behind the router, the router must know which internal computer should receive each incoming packet of data. Since ALL incoming packets of data have the same IP address (the single IP address of the router), the only way the router knows which computer should receive the incoming packet is if one of the internal computers on the private LAN FIRST sent data packets out to the source of the returning packets.

How is this done?
Since the NAT router links the internal private network to the Internet, it sees everything sent out to the Internet by the computers on the LAN. It memorizes each outgoing packet's destination IP and port number in an internal "connections" table and assigns the packet its own IP and one of its own ports for accepting the return traffic. Finally, it records this information, along with the IP address of the internal machine on the LAN that sent the outgoing packet, in a "current connections" table.

When any incoming packets arrive at the router from the Internet, the router scans its "current connections" table to see whether this data is expected by looking for the remote IP and port number in the current connections table. If a match is found, the table entry also tells the router which computer in the private LAN is expecting to receive the incoming traffic from that remote address. So the router re-addresses (translates) the packet to that internal machine and sends it into the LAN.

And here's the really good part:
If the arriving packet does not exactly match traffic that is currently expected by the router, the router figures that it's just unwanted "Internet noise" and discards the unsolicited packet of data.

With a NAT router protecting your connection to the Internet — even if you only have one computer on the LAN behind the router — none of the Internet scanning and worms and hackers and other annoying and malicious Internet nonsense can get to your computer or computers.

If the NAT router isn't already expecting the incoming data, because one of the machines on the LAN asked for it from the Internet, the router silently discards it and your private network is never bothered.

So now that we have the basics . . .

What's significant for our discussion is that all of the internal machines are interconnected on the same LAN. This is convenient for sharing files and data among the machines, but it creates a security problem if all of the machines are not equally secure and trustworthy. If any malware or Trojan software were to somehow get onto any one of the machines, and that machine is on the LAN with all of the others (as it normally is), the malicious software would have access to every other uninfected machine sharing the once-secure LAN. By sending "ARP broadcasts" to the LAN, an infected machine can determine the IP and "MAC" addresses of every other machine on the LAN . . . and go to work on them.

Malicious hackers know all about this LAN-side vulnerability. This is why many recent viruses and worms attempt to spread not only by scanning the Internet for additional vulnerable targets, but they also attempt to spread locally through Windows file sharing, RPC vulnerabilities, and many other well-known Windows insecurities. Once one machine gets hit, every machine on the LAN can fall victim.

 Machines on the "Semi-Secure" (middle) LAN can access the Internet, but they are protected by the "External NAT" from most Internet badness.

 Machines on the "Super-Secure" internal LAN can also access the Internet, first by going out through the "Internal NAT" and then the "External NAT". As with machines on the Semi-Secure LAN, the "External NAT" will keep unsolicited traffic from entering the network.

 Because the Semi-Secure LAN is on the OUTSIDE (WAN side) of the Internal NAT, the machines on the Semi-Secure LAN are unable to freely access the machines behind the Internal NAT.

 The machines behind the Internal NAT can access the machines in the middle, but NOT the other way around!

Where would TWO NAT routers be useful?

   Completely isolating a router's DMZ network and servers.

   Isolating an open or low-security wireless access point.

   Protecting one "high-value" machine from the rest of the network.

Let's look at each application in turn:

Now let's look at the second typical application:

Our final application example:

Protecting one "high-value" machine from the rest of the network:
Suppose that rather than protecting all of your network from one "external danger" — like a machine on a DMZ or a Wi-Fi access point — you want to protect one "high-value" machine from potential insecurity within the rest of your own network.

For example, suppose that each of your teenage kids has their own computer connected to your shared "family" LAN created by a single NAT router. Or you might be the boss in a small office, where everyone in the office is sharing a single NAT router. In either case, you might not like the idea, for whatever reason, of having your (dad or boss) computer on the same LAN network as everyone else. If your kids or employees were to get themselves infected, download or bring something really nasty home from school, it could quickly spread to all "peer" machines connected to the same LAN network.

As we have seen, NAT routers make valuable network security devices and offer much more flexibility than just being used to interface a local network to the Internet. They can also be used as "one-way security valves" to create layers of protected sub-networks.

We have more NAT router tips & tricks in store.  So stay tuned!