The first type of NAT, full cone, represents a static mapping from an external "ip:port" pair to an internal "ip:port" pair. Any external computer can connect to it using the external "ip:port" pair. This is the case in non-stateful firewalls implemented with the use of filters.

In the restricted cone scenario, the external "ip:port" pair is opened only when the internal computer sends data to an outside address. However, the restricted cone NAT blocks any incoming packets from a different address. In other words, the internal computer has to send data to an external computer before it can send data back.

The port restricted cone firewall is almost identical to the restricted cone. The only difference is that the incoming packet should come from exactly the same "ip:port" pair as the destination of the sent packet.

The last type of NAT is called symmetric...