I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working on?

I setup my own Ubuntu desktop as a NAT machine using the basic iptables rules and by adding one more NIC card. I used the following rules:

$ iptables -t nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
$ iptables -t filter -A FORWARD --in-interface eth1 -j ACCEPT

Is there any way I can see my NAT table?

4 Answers 4


You can use pystun to check nat type. Here https://pypi.python.org/pypi/pystun

$ pystun
NAT Type: Full Cone
External IP: <your-ip-here>
External Port: 54320
  • 1
    pystrun doesn't work on modern systems. pystun3 seems to be working fine (it's a fork of pystrun) pypi.org/project/pystun3
    – Abdul Rauf
    Commented Jul 26, 2023 at 8:01

You will need to run a client that connects to a server (that is not behind a NAT) based on STUN that will analyze your packets and return information. Additionally, TURN is a bit newer and also returns information to help identify the NAT type.

Here are some clients, stacks, software packages that may work. You will have to compile and find a server to connect to, or run your own server.


You can use stunclient from stuntman (http://www.stunprotocol.org):

$ stunclient stun.stunprotocol.org --mode behavior               
Binding test: success
Local address:
Mapped address:
Behavior test: success
Nat behavior: Address and Port Dependent Mapping

You can run iptables -S to dump a list of all the rules currently loaded into the filter tables in the kernel. You can optionally add a -t argument to specify a specific table to dump.

From man iptables:

   -S, --list-rules [chain]
          Print all rules in the selected chain.  If no chain is selected,  
          all chains  are  printed  like  iptables-save.Like every other  
          iptables command, it applies to the specified table (filter is  
          the default).

As for knowing what kind of NAT you are behind as a client, it's not readily available information. At most you can deduce how it is probably setup from looking at what it does to your traffic.

  • Can you please give me some idea how i can check that how my source ip address is modified in the path between me and destination host..is there any algorithm for this..which protocol can be used for this...can we do it using ICMP protocol? Commented Nov 21, 2011 at 4:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .