Table of Contents
Understanding the Basic Idea of NAT
Network Address Translation, usually shortened to NAT, is a technique that lets many devices in a private network share a smaller number of public IP addresses, often just a single one. It sits at the border between a private network and the internet, usually on a router or firewall, and quietly changes IP addresses in packets as they pass through.
In a typical home or small office, all your laptops, phones, and smart devices have private IP addresses. Your internet service provider only gives you one public IP. NAT is the reason all those devices can still browse the internet at the same time. It translates between the private world inside the network and the public world outside.
NAT does not exist inside the internet backbone. It is a feature at the edge of networks. Inside your local network your devices talk to each other using private addresses, and when traffic needs to go out to the internet, NAT modifies it so that it appears to come from a valid public address.
Where NAT Lives in the Network
NAT usually runs on the device that connects your local network to the wider internet. For a home user this is the home router. For a company this can be a firewall or an edge router.
On one side of the NAT device there is at least one public facing interface that has a globally routable IP address. On the other side there is at least one internal interface that carries private IP addresses. The NAT device looks at packets crossing between these sides and performs translations according to its rules.
NAT is not a function that end devices such as laptops or phones usually perform. It belongs at the boundary where a private address space ends and connectivity to external networks begins.
Private vs Public Perspective with NAT
From the point of view of devices inside the network, NAT is almost invisible. When a computer with a private IP address sends traffic to a website, it believes it is talking directly to the public destination using its own private source address. It does not know that anything will be rewritten on the way out.
From the point of view of the internet, things look very different. The outside world never sees those private addresses, which are not valid on the internet anyway. It only sees the public address of the NAT device. As a result, hundreds of devices can appear to the outside as a single IP.
This split view is central. Internally, addresses can be reused by many different organizations because those private blocks are not visible globally. Externally, the global routing system only sees and routes public addresses, including the address or addresses that belong to the NAT device.
The Core Translation Concept
NAT works by intercepting IP packets and altering certain fields so that they can travel in a different address space. At the simplest level, NAT takes an internal source address and replaces it with another address before sending the packet onward.
There are two basic directions for this process. When traffic moves from inside to outside, NAT usually changes the source address to a suitable public address. When the reply comes back from outside to inside, NAT must undo this change. It looks at the packet, figures out which internal address should receive it, restores that address as the destination, and sends the packet inward.
To make this possible, the NAT device keeps a small table of translations. Each entry in this table remembers how a particular flow of traffic was modified so that replies can be reversed correctly.
NAT must always remember how it translated a connection, so it can apply the inverse translation for returning packets.
Basic NAT Table Idea
The NAT table is a list of active mappings the device has created. Each time a new internal connection goes out to the internet, the NAT device may create a fresh entry. This entry stores at least the original internal address and the new translated address. In common forms of NAT it also remembers ports, but those will be discussed separately in another chapter.
When an outbound packet appears, the NAT device checks if a matching entry already exists. If so, it applies the same translation as before. If not, it creates a new entry, decides how to translate the address, and then forwards the modified packet.
When a packet comes from outside, the NAT device consults the table in the reverse direction. It looks at the translated values in the packet and finds the corresponding original internal values in the table. It then rewrites the packet so that the destination matches the internal device, and forwards it inside.
The table is temporary. Entries are removed after a period of inactivity or when the connection ends. This means that NAT automatically forgets old flows and can reuse the same addresses and ports again for new traffic.
Types of Address Translation at a High Level
Several common patterns of NAT behavior exist. They differ in how many inside addresses map to how many outside addresses and whether translations are done only for outgoing connections or also for incoming ones.
A basic way to think about these behaviors is the ratio between inside and outside addresses.
| Pattern name (informal) | Mapping idea | Typical use |
|---|---|---|
| One to one | One internal to one public | Publishing servers, simple translation |
| Many to one | Many internal to one public | Home networks, small offices |
| Many to few | Many internal to a small address pool | Larger sites with multiple public IPs |
All of these use the same basic table idea, but they choose different translated addresses and sometimes different additional values such as ports.
In the simplest one to one style, each internal private address always appears as the same single public address when talking to the outside. In the many to one style, which is by far the most common for internet access, different internal devices share one public address and are distinguished in the table mainly by port numbers.
Direction of Translation: Inside versus Outside
To understand NAT basics it is useful to think about who starts the communication. When an internal device initiates a connection to the internet, NAT creates or uses a mapping for that flow. This is sometimes informally called outbound or inside to outside traffic.
Replies that come back from the internet are outside to inside. NAT expects these replies, because it has a table entry from the original outbound packet. For most common basic uses of NAT, this means that outside hosts cannot simply start talking to internal devices on their own. They can only respond to traffic that was started from the inside.
This behavior provides a side effect that feels similar to a basic firewall. Internal devices can browse out, but unsolicited inbound connections from outside are generally blocked because the NAT device has no matching entry in its table. It is important to note that true firewalling is a separate function, but at a beginner level this side effect is part of why NAT feels like a security feature.
NAT and Sessions
Although NAT operates on individual packets, it pays attention to logical sessions. When a device opens a connection to a website, that series of packets is seen by NAT as one flow. The NAT device uses the same mapping for all packets in that flow until it ends or times out.
In practical terms, once an internal device has started talking to a remote endpoint, NAT remembers how it translated that flow. This makes communication stable from the point of view of both sides. The inside device always uses its private address. The outside server always sees the same external address for the duration of that connection.
When the flow ends, the NAT entry can be deleted after a delay. This cleanup prevents the table from growing without bound and allows reuse of addresses and other resources.
Limits and Side Effects of NAT
Since NAT modifies packets in a way that hides internal addresses, some protocols and applications can be affected. If a protocol writes IP addresses or ports inside the payload of a packet, beyond the usual headers, simple NAT cannot see or adjust those internal values. That can cause mismatches between what is written in the data and what is written in the headers. In practice, special helpers or other techniques are often used to make such protocols work through NAT.
Another side effect is that NAT breaks the original idea of end to end addressing, where every device could be directly reached by every other device using a unique global IP. With NAT, internal devices usually cannot be reached directly from the public internet unless special configuration is added to handle such inbound traffic.
Despite these limits, NAT remains extremely common because it helps conserve public IPv4 addresses and allows organizations to reuse private address ranges internally without coordination with the rest of the world.
Relationship Between NAT and IPv4 Address Shortage
NAT became widespread mainly because public IPv4 addresses are limited. Each unique host on the public internet would need its own IP if every device was directly visible. With billions of devices, this is not realistic in IPv4.
By placing many devices behind a single public IP that belongs to a NAT device, networks can grow without obtaining more public address space. Each organization uses private address ranges locally, and only a much smaller number of public addresses at the edge. This practical workaround for address shortage is one of the primary reasons NAT is so common today.
NAT is strongly associated with IPv4. Future addressing models, particularly with IPv6, are designed to reduce the need for NAT, but as long as IPv4 remains heavily used, NAT will remain a core concept for internet connectivity.