What Is NAT? Network Address Translation Explained

NAT (Network Address Translation) allows multiple devices on a private network to share a single public IP address. It is how your home router lets dozens of devices browse the internet — and it has significant security implications.

What Is NAT?

NAT (network address-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) Translation) is a technique that allows multiple devices on a private network to share a single public [IP address](/learning-center/what-is-an-ip-address-ipv4-ipv6-and-addressing-explained) when communicating with the internet. It works by translating private IP addresses to a public IP address (and back) at the network boundary — typically performed by a router or firewall.

Without NAT, every device on the internet would need its own unique public [[IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)](/learning-center/what-is-an-ip-address-ipv4-ipv6-and-addressing-explained). Given that IPv4 only supports ~4.3 billion addresses (and the world has far more connected devices), NAT is what has kept the internet running as IPv4 address space depleted.

Why NAT Exists

| Problem | Solution | |---------|----------| | IPv4-address-ipv4-IPv6-and-addressing-explained) has ~4.3 billion addresses | NAT lets thousands of devices share one public IP | | Organisations need internal addressing | Private IP ranges are reusable with NAT | | Internal network structure should be hidden | NAT provides a degree of obscurity |

Private IP ranges (RFC 1918) — reserved for internal use, not routable on the internet:

10.0.0.0     – 10.255.255.255    (Class A: ~16 million addresses)
172.16.0.0   – 172.31.255.255   (Class B: ~1 million addresses)
192.168.0.0  – 192.168.255.255  (Class C: ~65,000 addresses)

How NAT Works

The most common form is PAT (port-the-internets-core-protocol)-and-UDP-ports-explained) Address Translation), also called NAT overload or masquerading. It translates both IP addresses and port numbers).

Home network:
Device A: 192.168.1.10:54321 → router → 203.0.113.1:54321 → google.com:443
Device B: 192.168.1.11:54322 → router → 203.0.113.1:54322 → google.com:443

(From google.com's perspective: both requests come from 203.0.113.1)

The router maintains a NAT translation table:

| Private IP | Private port-and-UDP-ports-explained) | Public IP | Public Port | Destination | |-----------|-------------|-----------|-------------|-------------| | 192.168.1.10 | 54321 | 203.0.113.1 | 54321 | 142.250.80.46:443 | | 192.168.1.11 | 54322 | 203.0.113.1 | 54322 | 142.250.80.46:443 |

When the response arrives at the public IP, the router looks up the table and forwards it to the correct private device.

Types of NAT

Static NAT (One-to-One)

Maps one private IP to one public IP permanently. Used for servers that must be reachable from the internet.

192.168.1.10 ←→ 203.0.113.50 (always the same mapping)

Dynamic NAT (One-to-One from a Pool)

Maps private IPS to a pool of public IPs. Less common today.

PAT / NAT Overload (Many-to-One) — Most Common

Maps many private IPS + ports to a single public IP, differentiated by [port-and-UDP-ports-explained) number](/learning-center/what-is-a-port-tcp-and-udp-ports-explained). This is what your home router does.

Port Forwarding — Letting Traffic In

NAT blocks unsolicited inbound connections by default (since there is no entry in the translation table for them). To host a server behind NAT, you configure port-the-internets-core-protocol)-and-UDP-ports-explained) forwarding:

Incoming: 203.0.113.1:80  →  Forward to →  192.168.1.20:80 (web server)
Incoming: 203.0.113.1:22  →  Forward to →  192.168.1.20:22 (SSH server)

This is how home users run web servers, game servers, or remote desktop behind their router.

NAT and Security

What NAT Does for Security

  • Hides internal [IP addressing](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) from external observers
  • Blocks unsolicited inbound connections (acts like a basic firewall)
  • Attackers cannot directly initiate connections to internal devices

What NAT Does NOT Do for Security

  • Not a substitute for a firewall — NAT alone does not inspect traffic content
  • Outbound malware still connects freely (most malware initiates outbound connections)
  • port-the-internets-core-protocol)-and-UDP-ports-explained) forwarding rules can expose internal services if misconfigured

> Important: NAT is a side effect of address translation — it is not a security feature. Always use it alongside a proper firewall.

NAT and IPv6

IPv6-address-ipv4-ipv6-and-addressing-explained) provides enough addresses (340 undecillion) that NAT is technically unnecessary. Every device can have a globally unique IPv6 address-ipv6-and-addressing-explained). However, many organisations continue using NAT with IPv6 for security and policy reasons.

Common NAT-Related Issues

| Problem | Cause | Solution | |---------|-------|---------| | VPN tunnelling issues | Double NAT | Configure VPN passthrough | | VoIP / SIP call failures | NAT breaks SIP headers | SIP ALG or STUN/TURN | | Online gaming connectivity | NAT strict mode | Open NAT / port-the-internets-core-protocol)-and-UDP-ports-explained) forwarding | | Remote desktop not working | No port-the-internets-core-protocol)-and-UDP-ports-explained) forwarding | Add port forwarding rule |

Quick Recap

  • NAT translates private IP addresses to a public IP so many devices can share one public address
  • PAT (port-the-internets-core-protocol)-and-UDP-ports-explained) address translation) is the most common form — used by home routers
  • NAT maintains a translation table to track which internal device owns each connection
  • port-the-internets-core-protocol)-and-UDP-ports-explained) forwarding allows inbound connections to reach specific internal devices
  • NAT provides basic inbound blocking but is not a replacement for a firewall