diff --git a/mapping.go b/mapping.go
index 2f45726308c2246c9b3fd464f8267f43652f5812..b2aeb9c4d7e7ba8b84c2b4d923ddbaad32cc1bba 100644
--- a/mapping.go
+++ b/mapping.go
@@ -106,7 +106,9 @@ func (m *mapping) ExternalAddr() (ma.Multiaddr, error) {
 		return nil, ErrNoMapping
 	}
 
+	m.nat.natmu.Lock()
 	ip, err := m.nat.nat.GetExternalAddress()
+	m.nat.natmu.Unlock()
 	if err != nil {
 		return nil, err
 	}
diff --git a/nat.go b/nat.go
index 210512cd1ad3c90c80a2c8a14b161a587ab9325a..879b69c06d9815bae86499f0a632bb849ae2f77a 100644
--- a/nat.go
+++ b/nat.go
@@ -52,8 +52,9 @@ func DiscoverNAT() *NAT {
 // service that will periodically renew port mappings,
 // and keep an up-to-date list of all the external addresses.
 type NAT struct {
-	nat  nat.NAT
-	proc goprocess.Process // manages nat mappings lifecycle
+	natmu sync.Mutex
+	nat   nat.NAT
+	proc  goprocess.Process // manages nat mappings lifecycle
 
 	mappingmu sync.RWMutex // guards mappings
 	mappings  map[*mapping]struct{}
@@ -170,11 +171,13 @@ func (nat *NAT) establishMapping(m *mapping) {
 		comment = "libp2p-" + m.comment
 	}
 
+	nat.natmu.Lock()
 	newport, err := nat.nat.AddPortMapping(m.Protocol(), m.InternalPort(), comment, MappingDuration)
 	if err != nil {
 		// Some hardware does not support mappings with timeout, so try that
 		newport, err = nat.nat.AddPortMapping(m.Protocol(), m.InternalPort(), comment, 0)
 	}
+	nat.natmu.Lock()
 
 	failure := func() {
 		m.setExternalPort(0) // clear mapping