Network Address Translation (NAT)

Network address translation (NAT) is the process a router uses to swap the private IP addresses inside your network for a single public IP address that the internet can see, and then swap them back for the replies. It is the reason dozens of phones, laptops, and servers in one office can all reach the internet through one public address. NAT also hides your internal addressing from the outside world, which adds a thin layer of privacy. This guide explains what NAT is, how it works step by step, the three main types, and what it does and does not do for security. The part most people get wrong comes near the end.

Key Takeaways:

• Definition: network address translation rewrites the source or destination IP address in a packet header so private addresses can share public ones.
• Why it exists: there are only about 4.3 billion IPv4 addresses, and NAT lets thousands of devices share one, which is what kept IPv4 usable.
• Three types: static NAT (one-to-one), dynamic NAT (a pool of public IPs), and PAT, also called NAT overload (many private IPs behind one public IP, separated by port number).
• What gets shared: private IP addresses (the RFC 1918 ranges) are mapped onto one or more public IP addresses.
• Where it runs: a router or firewall at the edge of the network usually performs NAT; carriers and clouds run it at much larger scale.
• The catch: NAT obscures internal addresses, but it is not a firewall and should never be your only defense.

What Is Network Address Translation (NAT)?

Network address translation is a method that lets a network use private IP addresses internally while presenting one or more public IP addresses to the internet. A NAT device, almost always a router, rewrites the address fields in each packet as traffic crosses the boundary between the private network and the public internet.

Think of NAT as the receptionist at a company switchboard. Every employee has an internal extension that means nothing to the outside world. When a call goes out, the receptionist puts it through one public phone number. When a reply comes back, the receptionist knows exactly which extension to route it to. NAT does the same job for IP packets, mapping many private addresses to a shared public one and keeping track of which reply belongs to which device.

This is also why your home or office network can have hundreds of devices but show the world a single public IP. The private addresses (for example 192.168.1.x) never appear on the public internet. Only the translated public address does.

So NAT is the translation layer. The more useful question is what happens inside that layer when a packet actually crosses it.

How Does NAT Work, Step by Step?

NAT works by rewriting the IP address (and often the port) in a packet’s header, then storing that mapping in a translation table so the matching reply can be sent back to the right device. The whole exchange takes microseconds and is invisible to the user.

Here is what happens when a laptop on a private network loads a website:

1. Outbound request. The laptop (say 192.168.1.20) sends a packet to a web server. The source address is its private IP.
2. Translation. The NAT router replaces the private source address with the network’s public IP and records the swap in its NAT table, including the source port.
3. Delivery. The packet reaches the web server, which only ever sees the public address and replies to it.
4. Reverse lookup. The reply arrives at the router. It checks the NAT table, finds that this connection belongs to 192.168.1.20, and rewrites the destination back to the private address.
5. Hand-off. The router forwards the reply to the laptop. As far as the laptop knows, it spoke to the server directly.

The port number is the detail that makes this scale. When many devices share one public IP, the router assigns each connection a unique port so it never confuses one device’s reply for another’s. That port-tracking trick is the heart of PAT, the most common form of NAT, which the next section covers.

The Three Types of NAT: Static, Dynamic, and PAT

There are three main types of NAT: static NAT, dynamic NAT, and Port Address Translation (PAT, also called NAT overload). They differ in how many private addresses map to how many public addresses, and whether ports are used to tell connections apart.

Static NAT (one-to-one)

Static NAT maps a single private IP address to a single public IP address, and that mapping never changes. It is a fixed, one-to-one translation. You use it when an internal device, such as a mail server or a web server, needs to be reachable from the internet at a predictable address.

Dynamic NAT (a pool of public IPs)

Dynamic NAT assigns a public IP address from a pool as needed. When an internal device starts a session, the router hands it the next free public IP and releases it when the session ends. If the pool is empty, new sessions wait. It is many-to-many, but only up to the size of the pool.

PAT / NAT Overload (many-to-one, by port)

PAT lets many private IP addresses share one public IP address by giving each connection a unique port number. This is the type running on virtually every home and small-office router on the planet. Because it tracks ports, one public address can support thousands of simultaneous connections. When an exam or interview asks which NAT technique allows full IP masquerading while still letting internal services answer inbound traffic, the answer is PAT, paired with port forwarding (static PAT) to expose specific services.

Knowing the types is half the picture. The other half is knowing exactly which addresses NAT is allowed to translate, which trips up more people than the types do.

Which Addresses Does NAT Translate? Private vs Public IPs

NAT translates private IP addresses into public IP addresses. The private addresses are the ones that can be shared through NAT so that home and corporate devices can reach the internet through a smaller set of public addresses.

Private IP ranges are reserved by RFC 1918 and are never routed on the public internet. There are three blocks:

• 10.0.0.0 to 10.255.255.255 (a single large Class A block)
• 172.16.0.0 to 172.31.255.255 (sixteen Class B blocks)
• 192.168.0.0 to 192.168.255.255 (the range most home routers use)

Public IP addresses, by contrast, are globally unique and assigned by regional internet registries. NAT is the bridge: many devices on private ranges share the scarce public addresses. A small business we audited ran 240 devices on the 10.0.0.0 range behind two public IPs without a single conflict, because PAT kept every connection separated by port.

Sharing addresses is the mechanical benefit. The strategic question is why organizations bother, which comes down to a short list of advantages.

What Is the Primary Advantage of Using NAT?

The primary advantage of using NAT is conserving public IPv4 addresses: it lets an entire network share one or a few public IPs instead of needing a unique public address for every device. A second, related benefit is that it hides internal addressing from the outside world.

The full list of benefits looks like this:

• IPv4 conservation. With only about 4.3 billion IPv4 addresses for billions of devices, NAT is the main reason the internet did not run out of usable addresses years ago.
• Address privacy. Outsiders see one public IP, not your internal layout. Your topology stays hidden.
• Flexibility and easy renumbering. You can restructure internal addressing or change ISPs without touching every device, because the public-facing address is decoupled from the private ones.
• Cost control. Public IPv4 addresses are a paid, finite resource. Sharing them through NAT cuts that cost sharply.

At the edge of the network specifically, the advantage is sharpest: a single public IP at the perimeter can front an entire site, which is why “what is one advantage of using NAT at the edge of the network” resolves to the same answer, address conservation plus a hidden internal map.

Notice that one of those benefits, hiding internal addresses, sounds a lot like security. That overlap is where most of the confusion about NAT lives.

Is NAT a Security Feature? NAT, Firewalls, and Cybersecurity

NAT provides a limited security benefit by hiding internal IP addresses and blocking unsolicited inbound connections by default, but it is not a security feature in the way a firewall is. The security feature people mean when they ask about NAT is this: because the NAT table only has entries for connections your devices started, unrequested traffic from outside has nowhere to go and gets dropped.

Yes, that behavior keeps a lot of random scanning out. But here is the contrarian point most guides skip: NAT was designed to stretch addresses, not to inspect traffic. It does not read packet contents, enforce rules, block malware, or stop an attack that rides on a connection you opened. Treating NAT as your security layer is the mistake.

For real protection, NAT belongs behind purpose-built controls. A stateful cloud firewall enforces allow and deny rules and inspects sessions, while a web application firewall filters application-layer attacks like SQL injection and cross-site scripting that NAT never sees. At the transport layer, Layer 4 DDoS protection absorbs SYN and UDP floods that would otherwise exhaust a NAT device’s connection table.

Once you separate NAT from security, the next practical question is simple: which box on the network actually performs the translation?

Where Does NAT Run, and Which Device Performs It?

In a typical corporate environment, the network device that performs NAT is the router, usually the border or edge router that sits between the internal network and the internet. Firewalls and dedicated gateways commonly handle NAT too, because they already sit on that boundary.

Where NAT lives depends on the scale:

• Home and small office: the broadband router or modem-router runs PAT for every device in the house.
• Corporate networks: the edge router or perimeter firewall performs NAT, often alongside access rules and logging.
• Internet providers: carrier-grade NAT runs on large carrier platforms serving thousands of subscribers per public IP.
• Cloud platforms: a managed NAT gateway lets private cloud instances reach the internet for updates without exposing them to inbound traffic.

In modern cloud and edge setups, translation and traffic control increasingly happen at the transport layer rather than on a single on-premise box. A Layer 4 traffic gateway manages TCP and UDP flows at the edge, the same layer where port-based translation lives, giving teams predictable routing and protection without a hardware appliance.

That cloud and carrier scale raises a NAT variant that home users rarely meet but that quietly runs much of the modern internet: carrier-grade NAT.

Carrier-Grade NAT (CGNAT) and NAT in the Cloud

Carrier-grade NAT (CGNAT) is NAT applied at the scale of an internet provider, where many subscribers share a single public IPv4 address. It is how ISPs kept signing up customers after the global pool of fresh IPv4 addresses ran dry.

CGNAT adds a second layer of translation: your home router already does NAT, and then the carrier does NAT again on top of it. That double translation has real consequences:

• Hosting a server from home gets harder, because you no longer own a unique public IP.
• Online gaming and peer-to-peer apps can struggle to open direct connections.
• Abuse attribution gets murky, since hundreds of users can share one address, which matters for security teams reading logs.

In the cloud, NAT shows up as a managed NAT gateway. It gives private instances outbound internet access (for patches, package installs, and API calls) while keeping them unreachable from the outside. This is the default pattern for private subnets across the major clouds, and it is one reason the “migrate” and “upgrade” NAT searches show up: teams are moving on-premise NAT into managed cloud gateways.

CGNAT shows NAT scaling up gracefully, but scaling also exposes the trade-offs that come baked into every NAT deployment.

The Limitations and Downsides of NAT

NAT’s main limitation is that it breaks the internet’s original end-to-end model, where any device could address any other directly. By hiding devices behind shared addresses, NAT complicates anything that needs an inbound connection.

The practical downsides:

• Peer-to-peer and real-time apps suffer. VoIP, video calls, and gaming need workarounds like STUN, TURN, and ICE to punch through NAT.
• Some protocols need help. Application Layer Gateways (ALGs) have to rewrite addresses buried inside certain protocols, and they sometimes get it wrong.
• Troubleshooting is harder. Because addresses are rewritten, tracing a connection across the NAT boundary takes more effort.
• Connection-table pressure. A device under a flood of connections can exhaust its NAT table, which is one way a transport-layer attack degrades a network.

That last point is worth flagging for anyone running internet-facing services: protecting the connection table is a real operational concern, which is why a Layer 4 protection system focuses on filtering volumetric transport-layer attacks before they reach your infrastructure.

Understanding where NAT struggles is what turns it from a black box into a tool you can plan around.

Final Thoughts on Network Address Translation

Network address translation endures because it solves one problem cleanly: it lets a crowded private network share scarce public addresses while keeping internal details out of sight. Understand the three types, know that PAT is what almost everyone actually runs, and remember which addresses get translated, and the rest of NAT stops feeling like a black box.

The one principle worth carrying away is that NAT is a translation tool, not a security tool. It hides addresses, but it does not inspect, filter, or defend. Pair it with a real firewall and transport-layer protection, treat the address-sharing as the efficiency win it is, and you will design networks that are both economical and genuinely secure.

Key Questions About Network Address Translation