NAT Syslog · PTA compliance
Every NAT translation, accountable.
NAT Syslog collects the CGNAT port-block events your NAS already emits, keeps them for 13 months, and answers the only question that matters: which subscriber was behind this public IP and port, at this time.
The problem
CGNAT solved your IPv4 shortage. It created a legal one.
The mandate is specific
PTA requires that a public IP, port and timestamp be traceable to a subscriber for at least one year. “We use CGNAT” is not an answer — it's the reason you need the log.
CGNAT hides your subscribers
Hundreds of customers share each public IP. Without the port-block events from your NAS, the abuse complaint about 103.x.x.x at 02:31 could be any of them.
The question arrives with a deadline
When the letter comes, it names an IP, a port and a time — and expects an answer, fast. Grepping a year of raw syslog on a dead disk is not a compliance posture.
How it works
From raw syslog to a legal record, without touching it.
; NAS → collector, syslog :514 (UDP/TCP)<134>1 2026-07-16T20:29:34Z Dream-100G NAT - PTADD[nprng USERNAME="alindg10"ISADDR="100.64.19.216"XSADDR="144.79.234.13"PORTMN="5000" PORTMX="5999"] sender 10.208.1.1 ....... registered ✓parser .................. netelastic ; normalized row → ClickHousealindg10 · 144.79.234.13 · 5000–5999batched insert .......... okclickhouse down? ........ spool to disk, replay- 01
Only your fleet is heard
Register each NAS by name, IP and vendor. The collector drops everything else — and surfaces unknown senders so a new BRAS gets onboarded, not lost.
- 02
Vendor-aware, one row shape
NetElastic port-blocks and MikroTik RouterOS firewall logs parse into the same normalized translation row — username, inside IP, public IP, port range, time.
- 03
Nothing is lost
Batches that can't reach ClickHouse spool to disk and replay when it returns. A database restart is a delay in your record, never a hole in it.
The platform
Small surface. Serious guarantees.
13-month retention
Every PTADD/PTDEL port-block event kept for 13 months on a ClickHouse TTL — beyond the one year PTA requires, enforced by the schema, not by a cleanup script.
Built for billions of rows
ClickHouse with daily partitions, a (public IP, port, time) sort key and bloom indexes on username — range queries answer in milliseconds at CGNAT volume.
Device allowlist
The collector ingests only from NAS IPs you registered. Unknown senders are surfaced for onboarding, never silently logged or silently dropped.
Vendor-aware parsing
NetElastic RFC 5424 port-blocks and MikroTik RouterOS firewall logs, normalized into one row shape. New vendor, new parser — same search.
No log is lost
TCP transport, and a disk spool that buffers batches whenever ClickHouse is unavailable and replays them after. An outage is a delay, not a gap in your legal record.
CSV & PDF export
Search results leave as a CSV for analysis or a formatted PDF for the regulator's letter. Every search and export is written to the audit log.
The answer
The letter names an IP and a port. You name the subscriber.
; the regulator's questionwho was 144.79.234.13 : 5433on 2026-07-16 at 20:31 PKT? SELECT username, inside_ip, port_start, port_endWHERE public_ip = '144.79.234.13'AND 5433 BETWEEN port_start AND port_endAND event_time covers 20:31 → alindg10 · 100.64.19.216 · 5000–5999answered in ............. millisecondsexport .................. CSV · PDFsearch logged ........... audit_logSearch takes a date range plus any of public IP, port, PTADD/PTDEL, inside IP or username. The sort key and bloom indexes were designed for exactly this lookup — it stays fast at billions of rows.
Results export to CSV for your analyst or a formatted PDF for the reply to the regulator. Every search and every export lands in the audit log — who queried what, when.
The product
An interface for the worst day of your quarter.
Search by date, public IP and port; results in milliseconds.
The registered fleet — the collector's allowlist.
A formatted PDF for the regulator's letter.
Pricing
Priced for your network, not a page of tiers.
NAT Syslog is licensed per deployment, sized to your NAS count and event volume. Tell us what your core looks like and we'll quote it — and if you run Dream Radius, ask about running both together.
FAQ
Compliance questions, answered straight.
What exactly does NAT Syslog store?
Normalized CGNAT translation events: subscriber username, inside IP, public IP, port range, event type (PTADD/PTDEL) and timestamp — parsed from the syslog your NAS already emits. Not packet contents, not browsing history.
Why is retention 13 months?
PTA requires at least one year of traceability. The extra month is margin, enforced as a ClickHouse TTL so the retention promise is a property of the schema, not of someone remembering to run cleanup.
Which NAS vendors does the collector parse?
NetElastic (RFC 5424 port-block events) and MikroTik RouterOS (CGNAT firewall logs, deduplicated per connection) today. The parser layer is vendor-aware, so additional vendors are additions, not rewrites.
What happens to logs if the database goes down?
The collector spools batches to disk and replays them once ClickHouse returns. An outage delays the record; it doesn't put a hole in it — that distinction is the compliance requirement.
Can it handle our log volume?
The store is ClickHouse with daily partitions and a sort key designed for IP + port + time lookups — built for billions of rows on modest hardware. CGNAT event volume from a mid-size ISP is exactly its comfort zone.
Does NAT Syslog require Dream Radius?
No — it's a standalone product with its own UI and its own deployment. It pairs naturally with the CRM (the same NAS fleet feeds both), but either runs without the other.
Who can search the logs?
Only authenticated users of its panel, and every search and export is itself written to an audit log — who queried what, when. A legal record you can't account access to isn't much of a legal record.
Also from us
The subscriber in that log line? Dream Radius manages him.
Dream Radius is our ISP CRM built around FreeRADIUS — six reseller tiers, prepaid wallets, packages, NAS fleet and billing in one radius. The same NAS devices feed both products.