15.2 PAT

Understanding Port Address Translation

Port Address Translation, usually called PAT or NAT overload, is a specific form of Network Address Translation that lets many internal devices share a single public IP address. While NAT basics focus on translating private IP addresses to public ones, PAT adds the use of TCP and UDP ports so that hundreds or thousands of flows can reuse the same public IP without conflict.

This chapter focuses only on how PAT works, how it differs from simple NAT, and where it is typically used in an internet connection.

The Core Idea of PAT

Classic NAT without ports usually performs a one to one mapping between internal and external addresses. One private IP is bound to one public IP. This does not scale well, because public IPv4 addresses are scarce.

PAT solves this by combining IP address translation with port translation. The router keeps track of flows using both IP and port numbers. Internally, many different devices can use the same internal source port numbers at the same time, because the PAT device assigns unique combinations of public IP and public port values.

In short, PAT uses the tuple:

$$\text{Source IP, Source Port} \rightarrow \text{Public IP, Public Port}$$

to distinguish flows.

How PAT Works Step by Step

Consider multiple internal devices in a home network, all using the same internet connection with only one public IPv4 address from the ISP. Each device creates connections to servers on the internet.

Inside the LAN, a device sends a packet with a private source IP and a source port. The destination is typically a public IP and a well known destination port such as 80 for HTTP or 443 for HTTPS. When this packet reaches the home router that performs PAT, the router does the following:

1. It checks its translation table to see if there is already an active mapping for this internal source IP and source port.
2. If there is no mapping, it picks an available public source port number on the router’s public IP and creates a new entry in the PAT table. The internal source IP and port become associated with the chosen public port.
3. It rewrites the packet. The source IP changes from the private address to the router’s public IP, and the source port changes to the selected public port. The destination IP and destination port are usually left unchanged.
4. It forwards the packet towards the internet.

Return traffic from the internet is addressed to the router’s public IP and the translated public port. When this return packet reaches the router, it looks up the public port in its PAT table. It then replaces the destination public IP and port with the original internal IP and port from the stored entry and forwards the packet to the correct internal host.

The key element is the PAT table, a dynamic table of active translations, which holds entries such as:

Each entry is temporary and tied to the lifetime of the flow. After some idle timeout, the PAT entry is removed, and the public port is freed for reuse.

Relationship Between NAT and PAT

PAT is a special form of many to one source NAT. All internal private IP addresses share one or a few public IP addresses, and the router uses ports to keep flows separate.

You can think of it as:

• NAT without port translation: often one to one or many to few mappings, where each internal address is mapped to a dedicated public address or to a small pool.
• PAT: many internal addresses mapped to one public address, using different source ports for each translated flow.

PAT can also operate with a pool of public addresses if needed. In that case, the router has both multiple public IPs and many available port numbers across those addresses. Even then, the principle is the same. The combination of public IP and public port must be unique for each active flow.

Port Ranges and Port Overloading

To understand PAT, it helps to recall that TCP and UDP ports are 16 bit numbers. That means there are $2^{16} = 65536$ possible port values from 0 to 65535. Some ports are reserved and have special purposes, especially the well known ports from 0 to 1023. PAT devices normally avoid these for translations and instead use high ephemeral ports, often from 1024 upwards.

Because each public IP can use many thousands of unique ports, a single public address can support a very large number of simultaneous connections. This is why PAT is sometimes called NAT overload. The public IP address is not used once per internal host, it is reused and overloaded with many individual flows, distinguished by ports.

Note that PAT may run out of translations in extremely dense environments if:

1. The number of concurrent flows exceeds the available port space per public IP.
2. The device uses only a portion of the port range for translations, for example if it reserves parts of the range for special functions.

When this happens, new connections may fail until older entries time out. This limitation becomes significant in very large networks that rely heavily on PAT.

Source PAT vs Destination PAT Context

Most commonly, when people say PAT they refer to source PAT on the router that connects an internal network to the internet. In this scenario, the NAT device changes the source IP and the source port as packets leave the internal network.

There are also designs that use destination NAT combined with port translation, often called port forwarding. That concept is covered separately, but it is worth understanding the directional difference here.

Source PAT:

• Internal client connects out.
• Router modifies source IP and port.
• Enables many clients to share one public IP.

Destination NAT with ports:

• External client connects to a public IP and port.
• Router translates the destination IP and port to an internal server.
• Used to expose internal services.

This chapter focuses on source PAT, which is the default behavior in home routers and many enterprise edge routers.

PAT and TCP / UDP Sessions

PAT works very closely with the behavior of TCP and UDP. For each flow, the PAT device identifies and tracks the connection based on the 5 tuple:

$$\text{Source IP, Source Port, Destination IP, Destination Port, Protocol}$$

For TCP, the presence of a connection state with sequence numbers and flags allows the PAT device to expire entries in a controlled way when it sees a proper connection tear down or after long inactivity.

For UDP, which is connectionless, the PAT device must rely on timeouts only. It assumes that if no packets appear for a certain time for a given translation, the flow is over and can be removed.

Because PAT modifies ports, it affects higher layer protocols that embed IP addresses or port numbers inside their payloads. Some of those protocols need special helpers or application layer gateways in the router so that the internal information can be adjusted consistently. You do not need this detail for basic PAT understanding, but it is important to know that not every protocol works equally well through PAT without extra support.

Timeouts and State

The PAT translation table is a stateful structure. Each entry has metadata such as last activity time, protocol, and sometimes flags. The device applies timeouts depending on protocol type and state. For example, idle TCP entries are often kept longer than idle UDP entries.

If an entry is removed due to timeout, and later a stray packet arrives from the internet addressed to the public IP and port from the old mapping, the PAT device no longer knows which internal host should receive it. Such a packet is usually dropped. This is a core security effect of PAT, because it prevents unsolicited inbound sessions by default, unless a port forwarding rule or destination NAT entry is configured.

PAT in Home and Small Office Networks

Home routers from internet service providers almost always rely on source PAT. Typically, the ISP provides one public IPv4 address. Inside the home, users have many devices with private addresses. The router automatically performs PAT so that all devices can access the internet at the same time.

The behavior seen by internal devices is simple. They all believe they have direct access outward. They use their own private addresses and ephemeral ports. They are unaware that the router rewrites the packets and multiplexes all traffic on a single public IP.

From the perspective of external servers, all clients in the home appear to come from the same public IP. The only visible differences are the source ports and possibly higher layer identifiers inside the applications.

This asymmetric visibility is a direct result of PAT and influences how inbound connections work. By default, external hosts cannot initiate new connections to random internal devices, because there is no matching translation in the PAT table. Only flows that originate from inside the network tend to work without specific configuration.

PAT Scaling and Carrier Grade NAT

In larger environments, especially with IPv4 exhaustion, ISPs may use PAT at a much bigger scale. This is often called Carrier Grade NAT, which combines large pools of private subscriber addresses with PAT and sometimes multiple layers of NAT within the provider. While the detailed mechanisms of carrier implementations belong to a later topic, the logic at each PAT device is the same. The PAT table maps many internal addresses to one or more public addresses using ports as differentiators.

This multi level use of PAT makes it harder to provide inbound connectivity, troubleshooting, and some peer to peer protocols. However, the fundamental translation behavior is identical to what you see on a home router.

Key Characteristics of PAT

To summarize PAT behavior without repeating general NAT theory, focus on these specific characteristics.

First, PAT uses the same public IP address for many internal flows. It depends on port uniqueness on the public side for each active flow, not just on address uniqueness.

Second, PAT is inherently stateful. The translation table is built dynamically as flows start and is removed as flows end or time out.

Third, PAT by default favors outbound initiated traffic. Inbound connections generally require some form of static configuration such as port forwarding because the PAT device cannot guess which internal host should receive unsolicited inbound packets.

Finally, PAT is one of the primary reasons why IPv4 can still support a large global user base despite the limited number of public addresses. By using port numbers as a shared resource on top of addresses, PAT effectively multiplies the number of usable simultaneous flows for each public IP.