/daily-startup-idea/nat

“NAT for your identity. Behind one public IP (your face) sits a private /24of selves — work-you, drunk-you, the-you-mom-knows, the-you-only-your-therapist-has-met. We rewrite the source before it leaves your mouth, so mom never sees the packets bound for the group chat. Port forwarding for the three friends allowed to reach the real inside network. Hairpin NAT so you can talk about yourself at a party without the message going through your therapist first.”

The Problem

Every self in your head shares one uplink: your mouth. Without translation, packets meant for drunk_you leak straight out with src=you.public, and now mom knows about the Tulum trip.

iftop · eth0 · Thanksgiving 2025NAT: disabled

you.public:1024→ mom:80“the gravy is amazing”OK

you.public:1025→ cousin:443“the gravy is a war crime”LEAK

you.public:1026→ gc:443“send help, dad is doing bits”LEAK

you.public:1027→ ex:443“u up”LEAK

all four packets landed on mom’s phone. she is holding it far away and squinting.

The Solution

A stateful NAT sitting between your inner 10.0.0.0/24 and the rest of the room. Each inner self gets its own private address; we rewrite srcto your public face and remap the port to whoever’s actually meant to hear it. Return traffic gets demuxed by port and delivered to the right inner process. Mom never sees the connection table.

nat table · conntrack4 flows · 0 leaks

insideoutsidepeer

10.0.0.2 work_you

→you.public:8080boss

10.0.0.3 mom_you

→you.public:80mom

10.0.0.4 drunk_you

→you.public:31337group chat

10.0.0.5 therapist_you

→you.public:5150dr. patel

Port Forwards

A few chosen humans get to punch through the firewall and reach an inner self directly. Rules live in iptables. Adding your mother-in-law to the DMZ is a hard revert.

DNAT · /etc/self/forwards.conf

you.public:22 → 10.0.0.9 true_youyour best friend since 6th grade

you.public:443 → 10.0.0.7 crying_youyour sister, after 10pm only

you.public:80 → 10.0.0.3 mom_youmom (default route)

DROP any → * college roommate’s new husband

Failure Modes

NAT_LEAK

Wine #3 kernel-panics the translator. src reverts to the real address. Your boss now knows what you think of the Q3 roadmap.

PORT_EXHAUSTION

Family reunion. 42 concurrent aunts, 65,535 available ports. All slots taken by 2pm. New conversations get ECONNREFUSED. You go stand by the shrimp.

HAIRPIN_MISS

You tried to compliment yourself at a party. Packet went out, hit the router, came back — but the NAT lost the mapping. You said “thanks” to a plant.

STALE_CONNTRACK

You’re still routing 10.0.0.11 sad_you to a friend who moved to Lisbon in 2022. Every packet gets a 30s TCP timeout, then a like on their story.

Pricing

SNAT

Static one-to-one masquerade. Every self shares one port. Fine until two of them try to speak at once at brunch.

PAT

$16 / mo

Port Address Translation. Up to 64 concurrent inner selves. Per-peer rewriting. Conntrack GC every 4h while you sleep.

CGNAT

$2,400 / yr

Carrier-grade. For podcast hosts, wedding officiants, HR. Two layers of NAT and a private ASN for your therapist.

TAM

addressable market · adults with a “work laugh”

4.1B adults × 7 distinct selves × $0.32 / rewritten packet

= $9.1B / yr in unleaked packets

Methodology: our co-founder’s mother-in-law joined LinkedIn. Everything is now inside the DMZ. Signal: undeniable.

The Ask

$4M seed. 60% to the conntrack table, which has to survive one (1) family wedding without flushing. 25% to a real-time classifier that knows the difference between mom_you and drunk_you when the two voices sound identical after midnight. 15% to lawyers, in case impersonating yourself is illegal in Delaware.

Series A pitch: “We’re Cloudflare, but the origin is you.”