NAT

NAT (network address translation) is the technique by which a router or firewall rewrites the source or destination IP address, and usually the port, of packets that pass through it. In Internet addressing, its dominant use is to let many devices with private IPv4 addresses reach the Internet through one or a few public IP addresses.

NAT was introduced as a stopgap for IPv4 address exhaustion, and it became one of the most widespread functions in home routers, enterprise firewalls and carrier networks. It is not part of the original end-to-end Internet design, and it changes how applications, security policies and troubleshooting work.

How NAT rewrites packets and tracks connections

A NAT device keeps a translation table that maps internal address and port pairs to external ones. When an internal host opens a connection, the device replaces the private source address with its public address, often picks a new source port, records the mapping, and recalculates the IP and TCP or UDP checksums.

Reply packets arrive at the public address and port. The device looks up the mapping, restores the original private destination, and forwards the packet inside. Unsolicited inbound packets that match no entry are dropped, which is why hosts behind NAT are not directly reachable from outside unless a rule is configured.

The following table shows a simplified translation table on a home router with the public address 203.0.113.10.

Each entry has a timeout. TCP mappings typically last from several minutes to a few hours after the last packet, while UDP mappings often expire after 30 seconds to a few minutes, which is why long-lived UDP applications send keepalive packets.

Types of NAT and where each is used

NAT is a family of translation methods that differ in what is rewritten and in which direction. The table compares the variants that network engineers meet most often.

Port address translation (PAT), also called NAPT or NAT overload, is what most people mean by NAT. Because the port field has 16 bits, one public address can in theory carry about 65,000 simultaneous mappings per protocol and remote peer, although real devices impose lower limits.

Mapping and filtering behavior

Applications that need direct peer-to-peer traffic depend on how consistently a NAT maps ports and how strictly it filters inbound packets. The behavior is described in IETF terms as endpoint-independent, address-dependent or address-and-port-dependent.

Real-time communication uses STUN to discover the public mapping, TURN to relay traffic when direct paths fail, and ICE to try the candidates in order. Gaming consoles report the same behavior as open, moderate or strict NAT.

NAT compared with IPv6, firewalls and CIDR

NAT is often confused with neighboring concepts in Internet addressing. IPv6 removes the scarcity that made NAT necessary: with a typical /56 or /64 prefix, every device can have a globally unique address, so translation is not needed for reachability.

NAT is also not a firewall, even though the lack of inbound mappings blocks unsolicited traffic as a side effect. A stateful firewall enforces an explicit policy; IPv6 networks keep the same protection by using a stateful firewall without translation. CIDR, by contrast, is a way to describe address blocks and has no role in rewriting packets.

Limitations and operational pitfalls of NAT

NAT solves address scarcity at the cost of breaking end-to-end connectivity. The table lists the problems that appear most often and how operators address them.

Double NAT, for example a home router behind a carrier-grade NAT, adds another layer of state and makes port forwarding impossible from the customer side. Protocols that embed addresses, such as FTP and SIP, need application layer gateways, which can introduce their own bugs.

In everyday language

NAT works like the reception desk of an office building. Everyone inside has an internal extension number, but outgoing calls all show the company’s main number. The receptionist keeps a list of who called whom, so when an answer comes back, it is passed to the right desk.

Strangers calling the main number cannot reach a particular desk unless the receptionist has been told where to send them. That is why NAT saves public addresses and also makes devices at home harder to reach from outside.

Seen in the real world

A family has a laptop, two phones, a smart television and a game console at home, all with addresses in 192.168.1.0/24. The broadband provider assigns the router a single public IPv4 address, and the router’s PAT function lets all five devices browse at the same time through it.

The console reports a strict NAT type, and online voice chat fails with some players. Investigation shows that the provider uses carrier-grade NAT, so the home router itself has a shared address from the 100.64.0.0/10 range. The household asks the provider for a dedicated public IPv4 address, enables UPnP on the router for the console, and the console then reports an open NAT type with working voice chat.