Mapping addresses and ports
Basic NAT maps between address spaces. NAPT also maps an internal IP-and-port tuple to an external address-and-port tuple, allowing multiple hosts to share fewer external addresses.
Returning packets are translated using the applicable mapping and forwarded inward. Relevant packet fields change, making NAT more than a transparent cable between two networks.
References: [1]
Mapping and filtering differ
NATs differ in when an existing mapping is reused for another external destination. UDP and TCP also involve different state and timeout handling.
Filtering separately determines which arriving packets can cross the boundary. An application working behind one router therefore has no automatic guarantee under another mapping, filtering or timer policy.
Two endpoints behind one NAT can communicate through their external mappings using hairpinning. An internal sender addresses the other endpoint’s external address and port; the NAT uses its active mapping to relay the packet back inward, presenting the appropriate translated source. This is not ordinary direct LAN delivery, so sharing an internal network alone does not establish that external-mapping communication will work under the deployed forwarding and filtering behavior.
Application and security boundaries
An application embedding addresses in its payload may not survive merely rewriting outer headers. New inbound connections also require suitable mappings or coordination; an internal address alone does not establish reachability.
Translation describes rewriting, not confidentiality, authenticated identity or correct authorization. Those properties must be explained through separate filtering, encryption and access mechanisms.