What Is NAT (Network Address Translation)?

What Is NAT?

NAT translates the private IP addresses inside a home or office to the single public address the network presents to the internet, and translates the responses back. When you type a username on a site, that site only ever sees your router’s one public address; NAT is the bookkeeping that lets dozens of devices hide behind it. The defining traits of NAT are:

• Address translation: it rewrites the private source address of outgoing packets to the public address.
• A NAT table: it records each translation so the router returns each reply to the correct internal device.
• Address sharing: it lets many private devices reach the internet through one public address.
• Router placement: it runs at the boundary between the private network and the internet.

The private and public addresses NAT maps between are both explained in the overview of an IP address. The device that performs NAT is almost always the router at the edge of your computer network.

How Does NAT Work?

NAT works by having the router rewrite the source address and port of each outgoing packet to the public address, record the mapping, then reverse it on the reply. The translation table is what makes one public address serve many devices: each entry ties an internal address and port to an external port, so an arriving reply is matched to exactly one device.

• An internal device sends a packet. A laptop on 192.168.1.20 sends a request to a website using its private source address and a source port.
• The router rewrites the source. It swaps the private address and port for its own public address and a chosen external port.
• The router records the mapping. It writes an entry in the NAT table linking the internal address and port to that external port.
• A reply arrives. The router looks up the external port in the table and rewrites the destination back to 192.168.1.20, delivering the reply to the right device.

The most common form, port address translation (PAT), gives each connection its own external port so one public address can carry hundreds of sessions at once. The router tells connections apart by the network ports recorded in the table, even when every device shares the same public address.

Why Does NAT Exist?

NAT exists chiefly to conserve IPv4 addresses, because the IPv4 space cannot supply a unique public address to every device on the planet. It let private networks adopt internal address ranges while presenting one public address to the world. The reasons NAT exists are:

• IPv4 conservation: it stretches the limited 32-bit address space by sharing public addresses.
• Private addressing: it uses the reserved RFC 1918 ranges that never appear on the public internet.
• Address independence: an internal network keeps its own addressing even when the public address changes.
• Address hiding: outside hosts see only the public address, an incidental privacy effect, not a security control.

The IPv4 space holds about 4.3 billion addresses, far fewer than the number of connected devices, which is what made address sharing through NAT necessary. The successor protocol with a vastly larger space is set out in the IPv4 versus IPv6 comparison.

What Are the Private IP Ranges NAT Uses?

NAT relies on the three private address blocks reserved in RFC 1918, which routers on the public internet will never forward. Any address inside these ranges is free for anyone to reuse on their own network precisely because it stays internal:

• 10.0.0.0/8: 10.0.0.0 to 10.255.255.255, the largest block, common in big networks.
• 172.16.0.0/12: 172.16.0.0 to 172.31.255.255, a mid-sized block used in many organizations.
• 192.168.0.0/16: 192.168.0.0 to 192.168.255.255, the range almost every home router hands out.

Because these addresses are not globally routable, a device using one cannot reach the internet on its own. NAT is the bridge that swaps the private address for a public one on the way out and restores it on the way back.

What Are the Types of NAT?

The main types of NAT are static NAT, dynamic NAT, and port address translation (PAT), which differ in how they map private addresses to public ones. The type decides whether a mapping is fixed, drawn from a pool, or shared across one address by port.

PAT, also called NAT overload, is the form behind almost every home and office connection, letting all devices share one public address. Static NAT, by contrast, pins one public address to one device, which suits a server that must remain reachable at a known IP address.

Is NAT a Firewall?

No. NAT hides internal addresses and drops inbound packets it has no table entry for, but that is a byproduct of translation, not a security policy you can rely on.

The confusion is understandable, because PAT has to keep connection state to work at all, and a stateful firewall keeps similar state. The two jobs are separate: translation rewrites addresses, while a firewall enforces which connections may pass.

How Does NAT Relate to Port Forwarding?

Port forwarding is a static NAT rule that sends incoming traffic on a chosen public port to a specific device and port on the private network. NAT normally blocks unsolicited inbound connections, and port forwarding is the deliberate exception that lets an outside host reach an internal service.

• NAT blocks unsolicited inbound traffic because the router has no table entry for a connection it did not start.
• Port forwarding adds a fixed rule that maps a public port to one internal device and port.
• Incoming requests on that port are forwarded to the specified device behind NAT.
• Common uses include reaching a home server, a game host, or a security camera from outside the network.

Because the rule names a fixed internal address, the target device usually needs a steady one. The steps are covered in the guide to setting up port forwarding, often paired with a static IP for the target device so the rule keeps pointing at it.

What Is Carrier-Grade NAT (CGNAT)?

Carrier-grade NAT (CGNAT) is a second layer of NAT run by your internet provider, so many subscribers share one public address rather than each getting their own. As public IPv4 ran out, providers turned to CGNAT to keep serving new customers without buying scarce addresses.

• It uses a reserved range: RFC 6598 set aside 100.64.0.0/10 (about 4 million addresses) for the link between your router and the provider’s NAT.
• It creates double NAT: your router translates once for your devices, and the provider translates again before traffic reaches the internet.
• It breaks port forwarding: your router’s outside address is not public, so a rule you set at home never receives the inbound connection.
• How to spot it: a WAN address starting 100.64 to 100.127, or a router WAN address that does not match your public address, usually means CGNAT.

For hosting a server, gaming, or peer-to-peer traffic, CGNAT is the hidden reason a connection will not reach you. The lasting fix is IPv6, which gives every device its own public address and removes the need for these layers.

Does IPv6 Need NAT?

IPv6 largely does not need NAT, because its 128-bit address space supplies enough unique public addresses for every device to have its own. NAT exists mainly to conserve scarce IPv4 addresses, a constraint IPv6 removes outright. The reasons IPv6 reduces the need for NAT are:

• A vast address space gives every device a unique public address with no sharing.
• End-to-end addressing lets devices connect directly, the original design of the internet.
• No address scarcity removes the conservation motive that made NAT necessary for IPv4.
• A firewall, not NAT, provides the security boundary, using explicit stateful rules to block unsolicited inbound traffic.

IPv6 restores direct end-to-end addressing, so devices need no shared public address, though a stateful firewall still decides which connections are allowed. The differences between the two address versions are set out in the IPv4 versus IPv6 comparison.

What Is Double NAT and Why Does It Cause Problems?

Double NAT happens when traffic passes through two NAT devices in sequence, such as your own router placed behind another router, which complicates port forwarding and some applications. The address is translated twice, adding a second boundary that connections expecting a single one can stumble over.

• Two NAT layers appear when a router connects behind another router that also performs NAT, including provider CGNAT.
• Port forwarding breaks because a rule on one router does not pass traffic through the second.
• Some applications fail when they rely on a single, predictable NAT boundary, such as gaming and some VoIP.
• Resolving it means bridging one device or setting it to pass-through mode so only one NAT remains.

Double NAT most often shows up when a personal router sits behind an internet provider’s modem-router that also runs NAT. Setting one device to bridge or pass-through mode removes the second translation, restoring single-layer NAT and reliable port forwarding.

What Are the Advantages and Limitations of NAT?

NAT conserves IPv4 addresses and hides internal addressing, but it complicates inbound connections and breaks protocols that embed addresses in their own data. It solves address scarcity while adding constraints for any application that expects direct end-to-end addressing.

• Address conservation: many devices share one public address, the central advantage of NAT.
• Address hiding: internal addresses stay off the public internet, an incidental privacy effect, not a firewall.
• Inbound complexity: outside hosts need a port-forwarding rule to reach an internal device.
• Protocol breakage: applications that embed IP addresses in their payload can fail, because NAT rewrites headers, not payloads.

NAT breaks the original end-to-end model of the internet, which is why some applications need helpers or port forwarding to work behind it. The successor protocol that restores direct addressing is detailed in the IPv4 versus IPv6 comparison.

Last Thoughts on NAT

Network address translation maps private IP addresses to a public address, and back, so many devices on a private network share one public address through a router. It works by rewriting source addresses and ports and tracking each one in a NAT table, and it exists chiefly to conserve the limited IPv4 address space. The types are static, dynamic, and port address translation, with PAT behind nearly every home and office connection, and port forwarding adds a static rule that lets outside hosts reach an internal device.

NAT hides internal addresses, but it is not a firewall, and IPv6 keeps the firewall while dropping the translation. NAT is one piece of how traffic moves across a network. The hub on the computer network connects it to the wider set of networking topics.

Key Takeaways:

• NAT translates private IP addresses to a public address and back, letting many devices share one address.
• It works by the router rewriting source addresses and ports and tracking them in a NAT table.
• The private ranges are RFC 1918: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• PAT, also called NAT overload, is the many-to-one form used by nearly every home router.
• NAT hides internal addresses but is not a firewall; a stateful firewall provides the real protection.
• IPv6 largely removes the need for NAT, and CGNAT or double NAT can break port forwarding.

Frequently Asked Questions (FAQs)