NETWORK
NATNetwork Address Translation
NAT (Network Address Translation) lets a router rewrite the private source addresses of outgoing packets to its single public address, tracking each connection so replies can be sent back to the right device. It is why an entire home or office can share one public IPv4 address, and why inbound connections need port forwarding.
How translation works
A PC at 192.168.1.20 opens a connection from its ephemeral port 51000 to a web server at 203.0.113.5:443. The router, whose public address is 198.51.100.9, rewrites the packet:
| Source | Destination | |
|---|---|---|
| Inside | 192.168.1.20 : 51000 | 203.0.113.5 : 443 |
| Outside | 198.51.100.9 : 40123 | 203.0.113.5 : 443 |
It records the mapping in its translation table. When the reply arrives for 198.51.100.9:40123, the router looks up the entry, rewrites the destination back to 192.168.1.20:51000 and forwards it. Because the router also translates the port, thousands of devices can share one address; this variant is called PAT, NAPT or NAT overload, and is what every consumer router does.
Entries time out when idle (seconds to minutes for UDP, longer for established TCP), which is why long-idle connections sometimes drop and why keepalives exist.
Inbound connections
An unsolicited packet from the internet to 198.51.100.9:25565 matches no table entry, so the router drops it. To host a service you create a static mapping, a port forward: "external 25565 → 192.168.1.30:25565". Alternatives:
- UPnP / NAT-PMP / PCP: applications ask the router to create a mapping automatically (see port 1900). Convenient and risky.
- DMZ host: forward everything to one device. Avoid; it exposes that device completely.
- Outbound tunnels: mesh VPNs and relay services establish outbound connections from inside, so nothing inbound is needed.
NAT behaviours
RFC 4787 classifies how NATs map and filter:
| Behaviour | Meaning | Effect |
|---|---|---|
| Endpoint-independent (full cone) | Same external port for all destinations; any host can send to it | Peer-to-peer works easily |
| Address-restricted | External port reused; only hosts the client contacted can reply | Usually fine |
| Symmetric (address- and port-dependent) | New external port per destination | Breaks hole-punching; STUN gives no useful result |
VoIP (SIP), online games and WebRTC use STUN, TURN and ICE to work through these.
Carrier-grade NAT
When an ISP has fewer public addresses than customers, it applies NAT again inside its own network, giving customer routers addresses from 100.64.0.0/10. The result is double NAT with no access to the outer layer: port forwarding cannot work, and geolocation and abuse reports become imprecise. The private IP checker identifies CGNAT addresses.
Problems NAT causes
- Protocols that embed addresses in their payload (FTP, SIP, some VPNs) need an application-layer gateway or protocol-specific workarounds.
- Two sites with the same private range cannot be joined by VPN without translation.
- Logging and abuse handling see one address for many users.
- Long-lived idle connections drop.
IPv6 removes the need for NAT entirely; see IPv4 vs IPv6.
Observing it
From inside the network, netstat -ano on a PC shows the private source ports. The router's connection or NAT table (available on most business routers and some consumer ones) shows the translated public ports. Any "what is my IP" site shows the address after translation.
Frequently asked questions
Is NAT a firewall?
Not by design, but it has a similar effect for inbound traffic: with no matching table entry, an unsolicited inbound packet has nowhere to go and is dropped. Real firewalls add policy, logging and outbound control. IPv6 networks without NAT rely on the firewall alone.
What is double NAT?
Two NAT devices in series, usually an ISP modem-router plus your own router. Each layer needs its own port forward for inbound traffic to work. Fix it by putting the ISP device into bridge mode or by disabling NAT on one device.
What do NAT types on game consoles mean?
Consoles classify how restrictive the NAT is. "Open" (type 1 / full cone) means inbound traffic reaches the console freely; "Moderate" and "Strict" (symmetric NAT) limit who can connect, which breaks peer-to-peer voice and matchmaking. Port forwarding or UPnP moves a console toward Open.