What Is NAT (Network Address Translation)?

Updated on May 9, 2025

Network Address Translation (NAT) modifies IP addresses in packet headers to conserve IPv4 addresses, enhance security, and connect private networks to public ones. This guide covers the basics, functionality, and applications of NAT.

Definition and Core Concepts

IPv4 Address Depletion

The world is running out of IPv4 addresses, a challenge first recognized in the late 1980s. IPv4, the fourth version of the Internet Protocol, allows for approximately 4.3 billion unique addresses. With billions of devices connected to the internet today, this pool cannot meet global demand. NAT emerged to address this shortage by enabling multiple devices within a private network to share a single public IP address.

Private IP Addresses

NAT makes use of private IP addresses, which are reserved for internal network use. These addresses are not routeable on the public internet. Examples include:

• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

Devices within a private network are assigned one of these private IPs.

Public IP Addresses

Conversely, public IP addresses are globally unique addresses that devices on the internet use to communicate. NAT bridges the gap between private IP spaces and public-facing services by dynamically mapping private IPs to public ones.

NAT Router/Firewall

A NAT-enabled router or firewall is the central point where network address translation occurs.It translates private IP addresses and port numbers to a public IP address and potentially different port numbers for outbound traffic, and reverses this mapping for inbound responses.

Translation Table

NAT routers maintain a translation table to manage mappings between private IPs and public IP/port pairs. This table allows the device to direct responses back to the appropriate originating device.

Source NAT (SNAT)

Source NAT modifies the source IP address of a packet. For outbound traffic, SNAT replaces the private IP of the sending device with the router’s public IP address.

Destination NAT (DNAT)

Destination NAT, or port forwarding, allows incoming traffic destined for a specific public IP and port to be redirected to a private IP/port within the network.

Port Address Translation (PAT) / NAT Overload

PAT allows multiple devices on a private network to share a single public IP address by assigning unique port numbers to each device’s connection. This method is widely used for home networks and small-to-medium-sized businesses.

How It Works

Outbound Traffic (SNAT/PAT)

When a device within a private network sends a request to the internet:

1. The NAT-enabled router rewrites the source IP address in the packet header from a private IP to its public IP.
2. If PAT is used, a unique source port is assigned.
3. The router stores this mapping in the translation table.
4. The modified packet is forwarded to its destination.

The destination (e.g., a website) processes the request and sends a response to the router’s public IP address and the assigned port.

Inbound Traffic (DNAT)

For incoming packets, NAT processes traffic as follows:

1. The router checks its translation table for a matching public IP/port entry.
2. If a match is found, the destination IP address is replaced with the corresponding private IP from the table.
3. The modified packet is delivered to the intended device within the private network.

Translation Table Maintenance

NAT routers actively maintain the translation table. Each entry includes:

• Private Source IP and Port
• Public Destination IP and Port
• Protocol (TCP, UDP, etc.)
• Mapping Public IP and Port
• Private Destination IP and Port
• Timeouts to clear inactive mappings

This ensures dynamic connections are efficiently managed and resources are not needlessly allocated.

Key Features and Components

IPv4 Address Conservation

NAT significantly conserves IPv4 addresses by enabling multiple devices to share a single public IP. This is especially valuable in scenarios where public IP addresses are scarce or expensive.

Increased Security

By hiding internal device addresses behind a NAT router, NAT provides a layer of security. External parties cannot directly access devices on private networks unless explicitly allowed (e.g., via port forwarding).

Flexibility in Addressing Schemes

NAT allows internal network administrators to use private IP addresses however they see fit, without coordinating with an external address registry. This flexibility simplifies network configuration and expansion.

Use Cases and Applications

Home Networks

Most household routers are NAT-enabled, using PAT to allow multiple connected devices (e.g., laptops, phones, and smart TVs) to access the internet via a single public IP.

Enterprise Networks

Large organizations often use NAT to manage internal devices, conserve public IP addresses, and enforce internal security policies. NAT also simplifies merging networks during corporate expansions or acquisitions.

Connecting Private Networks to the Internet

NAT ensures seamless connectivity for devices on private networks by translating private IPs to public IPs. It allows devices with private IPs to communicate with online services without requiring public IP allocations.

Port Forwarding for Internal Servers

For businesses hosting internal services (e.g., a web server, FTP site, or VPN), DNAT enables public access while maintaining internal server security. Specific ports on the public IP are forwarded to internal IPs, ensuring data flows to the correct services.

Key Terms Appendix

• NAT (Network Address Translation): A method of modifying IP headers to enable communication between private networks and public networks.
• IPv4 Address: A numerical label assigned to devices on a network using the IPv4 protocol.
• Private IP Address: IP addresses reserved for internal network use, not globally unique.
• Public IP Address: Globally unique IP addresses used for internet communication.
• SNAT (Source NAT): Rewrites source IP addresses for outbound traffic.
• DNAT (Destination NAT): Rewrites destination IP addresses for inbound traffic.
• PAT (Port Address Translation): Enables multiple devices to share a single public IP address by using unique port numbers.
• Translation Table: A table that maps private-to-public IP/port pairs to facilitate bidirectional communication.