NAT and NAT tables

I will try to be simple in the explanation. You have mainly two types of NAT:

  • Source NAT: Typically known as 'masquerade', it masks your local IP address with his address so that it can communicate with hosts in networks that do not know the route to your local network.
  • Destination NAT: Usually known as 'port forwarding' it translates the destination network address to a local address in a foreign network.

I think what you are describing is a source NAT, your communication from your local network to a server in the internet. And what happens is as you said, but let me rephrase a little bit:

  1. You generate a connection from your local net to internet: 192.168.1.1 -> 137.132.1.15:PORT, your source port is random.
  2. Based on your routing table, in the local host with the IP 192.168.1.1, your packet will go to the next hop, usually your default gateway for internet destinations.
  3. when your packet arrives to a device that has a configured Source NAT, it will translate the source address, masquerading the source of the packet and converting it into 201.22.14.15 -> 137.132.1.15:PORT. And it will remember that this connection is from your local IP 192.168.1.1.
  4. Let's suppose that, as most of the times, 137.132.1.15 is a firewall that will NAT the destination port PORT to a foreign local network, for instance 10.0.0.1, and let's suppose it is a web server, so it will translate the packet as 201.22.14.15 -> 10.0.0.1:80.
  5. The server at 10.0.0.1 will receive then a request from 201.22.14.15, and when returning, the same thing will happen on the other way, based on his routing table, he will go back to 201.22.14.15.
  6. The router/firewall will need to masquerade on the other way, changing the packet addresses as 137.132.1.15 -> 201.22.14.15.
  7. Your router at 201.22.14.15 will receive the packet, will be able to detect that is related to the stream generated by 192.168.1.1 and will return the response. 192.168.1.1 will see a packet that comes from 137.132.1.15, as 10.0.0.1 has been masqueraded.

Hope it helps and it does not generate more confusion.

Side note

TCP connections are not organized in datagrams, they are streams. Datagrams are UDP.