NAT (Network Address Translation) is a method routers use to map private IP addresses on a local network to one or more public IP addresses when traffic leaves the network. It allows many devices to share a single public IP address and is the primary reason the internet has not run out of usable IPv4 addresses.
TL;DR — NAT sits at the edge of a network and rewrites the source IP address on outgoing packets (replacing the private IP with the router’s public IP) and the destination IP address on incoming reply packets (replacing the public IP with the correct private IP). This lets hundreds of devices behind a single router share one public IP address. PAT (Port Address Translation), also called NAPT, is the most common form — it uses port numbers to distinguish connections from different devices. NAT is a workaround for IPv4 exhaustion; IPv6 eliminates the need for it entirely.
The problem NAT solves
IPv4 supports approximately 4.3 billion unique addresses. As of 2011, IANA declared the global IPv4 address pool exhausted. There are far more internet-connected devices than available public IP addresses.
NAT solves this by letting an entire network — a home, office, or data center — use a single public IP address. Devices inside the network use private IP addresses (which are not routable on the internet), and the NAT router translates them to the public IP when traffic exits.
Private IP ranges reserved for internal use (RFC 1918):
| Range | CIDR | Common use |
|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Large enterprises, cloud VPCs |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Medium networks |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | Home and small office networks |
How NAT works step by step
Outbound packet (private → internet)
- Device
192.168.1.10sends a packet to93.184.216.34(example.com) on port 80 - The packet arrives at the NAT router with source:
192.168.1.10:54321 - The router replaces the source address with its public IP:
203.0.113.1:54321 - The router records the mapping in its NAT translation table:
192.168.1.10:54321 ↔ 203.0.113.1:54321 - The packet continues to the destination
Inbound packet (internet → private)
- The reply arrives from
93.184.216.34addressed to203.0.113.1:54321 - The router looks up
203.0.113.1:54321in its NAT translation table - It finds the mapping: destination should be
192.168.1.10:54321 - The router rewrites the destination IP and forwards the packet to the internal device
Types of NAT
Static NAT
A fixed one-to-one mapping between a private IP and a public IP. Every packet from the private device always exits with the same public IP.
Use case: Hosting a server internally that must be reachable from the internet at a consistent public IP address (e.g., a web server, mail server).
Dynamic NAT
A pool of public IP addresses is maintained. Private IPs are mapped to available public IPs from the pool on demand. When a session ends, the public IP is returned to the pool.
Use case: Organizations with multiple public IPs that want to share them across internal users without static assignment.
PAT — Port Address Translation (most common)
PAT maps many private IP addresses to a single public IP address by differentiating connections using port numbers. Also called NAPT (Network Address Port Translation) or “NAT overload.”
Every outgoing connection from any device gets a unique source port number at the public IP. The NAT table tracks which private device owns each port.
Example with PAT:
| Private source | Public source (after NAT) | Destination |
|---|---|---|
| 192.168.1.10:49001 | 203.0.113.1:40001 | 93.184.216.34:80 |
| 192.168.1.11:52344 | 203.0.113.1:40002 | 93.184.216.34:80 |
| 192.168.1.12:61000 | 203.0.113.1:40003 | 8.8.8.8:53 |
A single public IP can support up to 65,535 simultaneous connections per destination port using PAT.
CGNAT — Carrier-Grade NAT
ISPs use CGNAT to apply NAT at their own infrastructure level before traffic reaches customers. Customers receive addresses from the 100.64.0.0/10 range (RFC 6598) — a shared address space that is not publicly routable. CGNAT adds a second layer of translation on top of any NAT the customer’s router performs.
CGNAT complicates hosting services, VPNs, and peer-to-peer applications because inbound connections cannot reach a device behind two NAT layers.
NAT and security
NAT provides an incidental security benefit: devices behind a NAT router are not directly reachable from the internet because they have no public IP. Unsolicited inbound packets have no NAT table entry to match, so the router drops them.
This is not a firewall. NAT does not inspect packet content, enforce access control policies, or block malicious traffic that arrives as a reply to an outgoing connection. A separate firewall is required for real security enforcement.
| NAT behavior | Security implication |
|---|---|
| Drops unsolicited inbound packets | Reduces attack surface for devices with no open ports |
| Allows all outbound traffic | Provides no protection against outbound malware or data exfiltration |
| Does not inspect payload | Cannot block application-layer threats |
| Translation table tracks state | Acts as implicit stateful connection tracking |
NAT limitations
Breaks end-to-end connectivity. The original IP architecture assumes every device has a globally unique address. NAT breaks this assumption. Protocols that embed IP addresses in their payload (SIP, FTP, H.323) fail or require Application Layer Gateways (ALGs) to function through NAT.
Complicates peer-to-peer applications. VoIP, gaming, video conferencing, and torrent clients rely on inbound connections. Techniques like STUN, TURN, and hole-punching exist specifically to work around NAT.
Introduces latency. Every packet requires a table lookup and address rewrite, adding a small processing overhead at the router.
CGNAT makes troubleshooting harder. With multiple NAT layers, identifying the source of a problem or tracing a specific connection requires cooperation between ISP and customer.
NAT vs IPv6
NAT is a workaround for IPv4 address exhaustion. IPv6 with its 340 undecillion addresses provides every device on earth a globally unique, publicly routable address — eliminating the need for NAT entirely.
| Aspect | NAT (IPv4) | IPv6 |
|---|---|---|
| Address space | 4.3 billion public IPs shared | 340 undecillion unique addresses |
| End-to-end connectivity | Broken | Preserved |
| Inbound connections | Requires port forwarding | Direct |
| Peer-to-peer | Requires workarounds (STUN/TURN) | Native |
| Adoption (2026) | Still dominant | ~40% of internet traffic |
Frequently asked questions
What is NAT? NAT (Network Address Translation) is a process performed by routers that replaces private IP addresses with a public IP address on outgoing traffic, and reverses the translation for incoming replies. It allows many devices on a private network to share one public IP address and is the primary mechanism that has extended the usable life of IPv4.
What is the difference between NAT and PAT? NAT is the general term for address translation. PAT (Port Address Translation) is the most common form of NAT, where many private IP addresses share a single public IP, differentiated by port numbers. PAT is what your home router uses — it allows dozens of devices to share one public IP by tracking connections via unique port assignments.
Does NAT protect against hackers? NAT provides a limited incidental security benefit by making devices with no open ports unreachable from the internet. It is not a firewall and does not inspect traffic, block malicious content, or enforce access policies. A dedicated firewall is required for actual security.
What is static NAT used for? Static NAT creates a permanent one-to-one mapping between a private IP and a public IP. It is used for internal servers that must be consistently reachable from the internet at a fixed public IP address, such as web servers, mail servers, or VPN endpoints.
What is CGNAT? Carrier-Grade NAT (CGNAT) is NAT applied by an ISP at their network level. Customers receive addresses from the shared 100.64.0.0/10 range and go through NAT twice — once at their own router and again at the ISP. CGNAT is used when ISPs lack enough public IPs to assign one per customer.
Why does NAT break some applications? Some protocols embed IP addresses inside the packet payload (not just the header), such as SIP (VoIP) and FTP. When NAT rewrites the header IP, the embedded IP in the payload becomes incorrect, breaking the protocol. Application Layer Gateways (ALGs) are used to also rewrite these embedded addresses, but they add complexity.
Will IPv6 eliminate NAT? Yes. IPv6 provides enough addresses to give every device a globally unique, publicly routable address, removing the need for address sharing through NAT. End-to-end connectivity is restored in IPv6, simplifying peer-to-peer applications, VoIP, and network troubleshooting.