The Necessity of NAT
Due to the long-term scarcity of IPv4 addresses, mobile operators generally allocate private network addresses (such as 10.x, 100.64 CGNAT ranges) for IoT SIM cards, and map them to a small number of public addresses through NAT (Network Address Translation) at the core network or NAT gateway. For services, terminals can still actively access the internet or enterprise VPN, but external hosts cannot freely initiate connections to the terminal's private network address unless a static mapping is established or a reverse tunnel is used. Understanding this helps distinguish whether a "platform cannot reach the device" issue is truly a network problem or an architectural limitation.
Sessions and Timeouts
NAT device maintains a five-tuple session table; after idle timeout, the mappings are recycled, and long connections may silently break. If IoT uses MQTT long connections or custom TCP, application-layer heartbeat and TCP keepalive should be configured, with intervals shorter than the typical NAT timeout of operators (which vary across networks). UDP-type protocols are even more sensitive and require periodic bidirectional packets to maintain the mapping. If the device enters PSM deep sleep, the original mapping may be invalid upon wake-up, so session reconstruction logic should be designed.
Differences between symmetric and cone NAT
Different NAT behaviors (Full Cone, Restricted, Symmetric, etc.) affect P2P, voice, and certain VPN modes. IoT rarely implements end-to-end P2P, but if using WebRTC or hole punching solutions, verification in the current network is needed in advance. On the enterprise side, if using an IP whitelist, note that the terminal's public IP may change with base station switching or CGNAT rotation; device certificates or fixed dedicated access lines should be used instead.
Troubleshooting suggestions
When the business side observes "occasional disconnections," capture source port changes and TCP states on the module side and compare with platform firewall logs. If ICMP is blocked, PMTUD and some diagnostic tools may show distorted results, so judgments should be based on combined application logs. For scenarios requiring active push from the cloud, prioritize device-initiated long connections to the platform or SMS wake-up, rather than assuming direct public access to the terminal's private IP.
Address sharing and mapping entries
Carrier NAT rewrites the private addresses and ports of many IoT SIMs into different ports on a small set of public addresses, so a terminal can open a connection to a server outside. A mapping entry records at least the source address, source port, destination address, destination port, and protocol. After the entry has been idle for a while it is deleted, and a packet from the public side back to the original private port then has nowhere to go. “The terminal can reach the internet” and “the server can find the terminal at any time” are two different things. A stable inbound path needs a static port mapping or a private line. The public address on an ordinary internet APN may also belong to carrier-grade translation, and the exit address can change when the site or the load changes.
The architecture should assume the device opens the session to the platform first, and an application heartbeat renews the mapping. The heartbeat interval must be shorter than the time that network actually reclaims the entry. That time differs by operator and by APN. Measure it on the live network. Do not copy a home router’s default. When the device must be woken, deliver the wake by SMS or by a long connection the platform already has, rather than connecting to the SIM’s private address. UDP has no connection state and depends even more on traffic in both directions to renew the mapping. A periodic report that only sends, and never receives, finds the mapping gone when the far end replies.
A port that is dead after sleep and wake
The device enters deep sleep without closing TCP. After wake, the old socket still says it is connected. The first data packet discovers that the mapping was reclaimed, and the application rebuilds only after several retransmissions. The server puts the terminal’s exit IP on an allow list. One rotation of CGNAT takes the whole fleet offline, and operations blames the module. Under symmetric translation, the external port the terminal uses toward server A is not the port it uses toward server B, so a hole punched toward A cannot be used to reach B. With ICMP blocked, someone treats a failed ping as proof that NAT is absent, while business TCP is in fact working. A long connection with no heartbeat, relying on TCP keepalive’s default of two hours, has already lost its mapping. The NAT in the middle reclaimed the entry long before that.
After wake, register again. Do not reuse the socket from before sleep. If the address family is IPv6 and this translation is no longer in the path, the path is different and has to be checked on its own; see cellular IPv6. A large packet can also fail while the mapping is still valid, because of path length. That is MTU and fragmentation. Do not mix it with an entry timeout as the same kind of disconnect.
Measure the mapping timeout with a real card on the target access point. Open a session, stop sending, and lengthen the idle interval until the server no longer receives a reply. Set the heartbeat inside that time, with margin. The first message after deep-sleep wake should be a fresh registration, not business data. The server should not treat the exit address as the device identity. The address rotates with the translation equipment. Put identity in a certificate or a device number. When inbound access is required, switch to an SMS trigger or a private line with a fixed mapping, and write in the design note that an ordinary internet access point cannot be called. When tracing a disconnect, look at whether the port on the module side changed and whether the server is still sending to the old port. The two sides match only if they are the same session.
Write the heartbeat interval as a configuration item, and record the access point used for the measurement. Do not represent device identity with the exit address. Separate the registration packet after wake from the business packet. Do not send data that must arrive reliably until registration has finished. State in the design that an inbound need moves to a trigger or a private line, so the project does not discover late that the device cannot be called.
The external mapping from one device toward two destination ports can differ. Using a port that was opened toward one server to reach another server fails. Record that in the joint-debug note, so the field does not keep swapping antennas.