Network Address Translation
We use this whenever many devices must share one external facing network.
For example, a home network has one public IP address from the ISP. In container networks, all containers share the host's IP address when they send packets out.
Connection Tracking
This is part of every device that does NAT. It tracks all outgoing connections and their matching incoming ones.
When a packet goes out, the source IP and port are swapped. They become the external IP and a unique port. This mapping is saved in the connection tracking table.
When a response comes back, the device looks up the destination IP and port in the table. It swaps them back to the original source IP and port. Then it forwards the packet to the internal device.
Port Forwarding
It's a sub-type of NAT. Incoming packets to a given port on the external IP go to a set internal IP and port.
Port forwarding is purely about incoming connections. It maps a request to another IP and forwards it to the internal device.