What Is Network Address Translation (NAT)? How It Works

What is Network Address Translation (NAT)?

Network Address Translation (NAT) is a packet-forwarding technique that rewrites an IPv4 source or destination address as traffic crosses a router, firewall, or other middlebox. Many implementations also rewrite a TCP or UDP port and update the affected checksums. The device keeps a mapping, or translation state, so return traffic can be associated with the correct internal flow.

A “NAT IP address” or “natted IP” is not a separate type of IP address. It means the address visible on one side of a translation. For example, a laptop may use private address 192.168.1.25 while an internet service sees the public address assigned to the NAT gateway.

How does NAT work?

1. An internal device starts a flow. A client such as 192.168.1.25:51514 sends traffic to an external service.
2. The gateway selects a translation. With Port Address Translation, it may rewrite the source to 203.0.113.10:62001 and record the internal and external address, port, protocol, and state.
3. The remote service replies. The response is addressed to the translated public tuple.
4. The gateway reverses the mapping. If the reply matches active state, the gateway restores the internal destination and forwards the packet.

Unsolicited inbound traffic normally has no matching state. Publishing a service therefore requires an explicit destination NAT or port-forwarding rule, a route, and a separate firewall policy. A one-to-one mapping does not by itself authorize or secure inbound access.

Types of NAT

Common IPv4 NAT functions

Function	What changes	Typical use	Important limit
Source NAT (SNAT)	Source address, and sometimes source port	Private clients reaching another network	Return traffic must match the mapping or an explicit rule
Destination NAT (DNAT)	Destination address, and sometimes destination port	Publishing an internal service or steering traffic	Routing and firewall permission are still required
Static one-to-one NAT	One fixed inside address to one fixed outside address	Stable bidirectional mapping	Consumes an outside address and does not create a security policy
Dynamic NAT	Inside addresses use temporary addresses from a pool	Outbound sessions where a public pool is available	Mappings may change and the pool can be exhausted
NAPT or PAT	Addresses and transport ports	Many devices sharing one or several public IPv4 addresses	Port and state capacity are finite

People often use “NAT” to mean PAT or NAT overload because that is the common home and small-office design. NAT44 translates IPv4 to IPv4. NAT64, which helps IPv6-only clients reach IPv4 services, is a different architecture with DNS and application considerations.

What is the purpose of NAT?

• Conserve public IPv4 addresses: NAPT lets many private endpoints share a smaller public pool.
• Separate internal and external addressing: An organization can renumber or merge internal networks without exposing every internal address externally, provided dependencies are understood.
• Publish or steer selected services: DNAT can map a stable public endpoint to an internal destination as part of a documented routing and firewall design.
• Apply address policy at a boundary: NAT can resolve overlapping address space or define which address another network observes, although avoiding overlap is usually easier to operate.

NAT is not encryption, authentication, malware filtering, or a firewall. The absence of an inbound mapping can reduce unsolicited reachability in some designs, but the firewall is the control that permits or denies traffic. Security still requires least-privilege rules, patching, identity controls, monitoring, and tested incident response.

NAT limitations and operational risks

• End-to-end reachability changes: Inbound services, peer-to-peer applications, VoIP, gaming, and some VPN protocols may need explicit mappings or traversal services such as STUN or TURN.
• Some protocols carry addresses in payloads: Application gateways can rewrite selected protocols, but they add state and do not solve every encrypted or custom protocol.
• Ports and state can run out: High connection rates, long timeouts, uneven subscriber allocation, or small public pools can exhaust mappings before link bandwidth is full.
• Attribution needs complete logs: A public IP alone may represent many internal devices. Retain synchronized timestamps, time zone, protocol, internal tuple, translated tuple, destination, and lifecycle events according to policy.
• High availability is stateful: A failover pair may need synchronized translation state. Otherwise established sessions can reset during a device failure or maintenance event.
• Double NAT multiplies failure points: Two translators can complicate port forwarding, discovery, VPNs, gaming, troubleshooting, and ownership of the public mapping.

NAT is not inherently slow. Performance depends on packet rate, connection setup rate, table size, features, logging, hardware offload, and the capacity of the device. Measure state use, allocation failures, drops, latency, and CPU instead of assuming translation alone is the bottleneck.

NAT vs firewall, proxy, VPN, and CGNAT

Different network functions that are often confused with NAT

Function	Primary job	Does it encrypt traffic?
NAT	Rewrite network addresses or ports and maintain mappings	No
Firewall	Permit, reject, or inspect traffic according to policy	No, unless combined with another feature
Proxy	Terminate and originate a connection on behalf of a client or service	Only when the proxied protocol or tunnel provides it
VPN	Encapsulate traffic between authenticated endpoints; many VPNs also encrypt it	Usually, depending on the protocol
CGNAT	Provider-scale address and port translation shared across subscribers	No

Carrier-Grade NAT can place another translator upstream of the customer router. That can limit inbound hosting and make a public address lookup show an address shared with other subscribers. See the CGNAT guide for detection and alternatives.

NAT design and troubleshooting checklist

1. Define the goal: outbound sharing, service publication, address overlap, migration, or provider-scale conservation.
2. Draw each hop and record the pre-NAT and post-NAT source and destination tuple in both directions.
3. Verify routes and firewall rules separately from the translation rule.
4. Size public addresses, source-port allocation, connection state, timeouts, logging throughput, and failover behavior.
5. Preserve time-synchronized logs that can connect an internal flow to its translated public flow without retaining more data than policy permits.
6. Test outbound, return, unsolicited inbound, port forwarding, hairpin access, fragmentation or MTU-sensitive traffic, failover, and rollback.
7. Check for an upstream translator before changing the local router; accidental double NAT is a common cause of failed inbound tests.

When a dedicated public IPv4 address may help

A dedicated public IPv4 address or block can simplify stable inbound services, allowlists, routing ownership, abuse attribution, and capacity planning, but it does not remove the need for a firewall or sound operations. Compare the required prefix size, route model, RPKI and LOA responsibilities, reputation evidence, abuse contacts, price, term, renewal, and exit plan. Review managed IPv4 leasing or the public IPv4 marketplace without assuming that inventory, price, or suitability is guaranteed.

NAT FAQ

Is NAT the same as a firewall?

No. NAT rewrites addresses or ports; a firewall applies traffic policy. The two functions often run on the same device, but they must be designed and audited separately.

What is a NAT IP address?

It is the address observed after translation. The internal endpoint may use one address while the network on the other side sees the translated address and, with PAT, a translated port.

What is the difference between NAT and PAT?

NAT is the broader family of address-translation functions. PAT, also called NAPT or overload, translates transport ports so many internal flows can share one public IPv4 address.

Does NAT slow down internet access?

Translation uses device resources, but a correctly sized gateway may add negligible delay. Investigate packet rate, state and port use, logging, CPU, drops, and feature processing before attributing a slowdown to NAT.

Why can double NAT cause problems?

Each translator owns separate mappings and timeouts. Port forwarding, VPNs, peer-to-peer traffic, gaming, logging, and troubleshooting may require coordinated rules on both devices.