What Is NAT, and How Does It Work?

NAT, short for network address translation, changes IP address information in packets as they pass through a router or gateway. Its most familiar use is letting several devices on a private IPv4 network share one public IPv4 address.

For example, a laptop and a phone can have different addresses at home while websites see the same public source address for both. NAT connects those two views of the network.

Why do networks use NAT?

Private IPv4 addresses are reusable inside separate networks, but they are not globally routable. Public IPv4 addresses are limited, so giving every internal device its own public address is not always practical.

Address-sharing NAT lets a network use private addresses internally and fewer public addresses for outgoing communication. Other NAT configurations can translate between address ranges without sharing one address among many devices. RFC 2663 explains this broader terminology.

Our public vs private IP guide covers the address categories. Here, the focus is what happens as traffic crosses the gateway.

How does NAT work? A simple example

Imagine two devices connecting to the same example website, 198.51.100.80, over HTTPS on TCP port 443. Both happen to use local source port 50000.

Their gateway uses 203.0.113.10 as its internet-facing address:

The external addresses are from documentation-only ranges, and the ports are illustrative.

The gateway records each mapping. The website replies to the translated address and port, and the gateway translates the destination back to the correct local device.

The distinct port mappings keep these connections separate even though they share a public address. This mechanism is called network address and port translation, or NAPT, in RFC 3022. It is also commonly called PAT, or port address translation.

What are the common NAT types?

You may encounter several labels:

These labels describe different aspects of the mapping. An address-sharing gateway can use a fixed public IP while creating temporary mappings for individual connections.

You may also see source NAT, which changes a source address, and destination NAT, which changes a destination address. Outgoing address sharing commonly uses source translation; directing incoming traffic toward an internal service commonly uses destination translation.

Is NAT the same as routing?

No. Routing chooses where a packet should go next. NAT changes addressing information in that packet. A router can forward traffic between networks without translating it.

For example, an office can route between an employee subnet and a printer subnet while preserving both devices’ addresses. See What Is a Subnet? for how those network segments fit together.

NAT does not remove the need for valid routes. The gateway must still know where to send translated packets and how returning traffic will reach the internal network.

What is port forwarding?

Port forwarding is a configured mapping that directs traffic arriving at an external address and port to a particular internal service.

This differs from the temporary mapping created when an internal device starts an outgoing connection. With a suitable forwarding rule, an outside client can initiate a connection to the mapped service. The traditional NAT specification describes this use of static service mappings.

The service must be running, and the routing and firewall rules must allow the traffic. Port forwarding on a home router alone may not provide public reachability if another NAT device sits upstream.

What are double NAT and CGNAT?

Double NAT means traffic passes through two translating devices. One example is a personal router connected behind another router that also performs NAT.

Carrier-grade NAT, or CGNAT, applies address sharing in a provider’s network, potentially across multiple customers. It can exist in addition to NAT in the customer’s home.

The provider may use 100.64.0.0/10 between customers and its NAT infrastructure. This is shared address space defined in RFC 6598, separate from the usual private IPv4 ranges.

This helps explain why your router’s WAN address might differ from the address a website sees. It also explains why controlling your own router does not necessarily give you control over the final public mapping.

What does a NAT gateway do in a cloud network?

A cloud NAT gateway can translate outgoing traffic from workloads that use internal addresses. Those workloads need routes that direct the relevant traffic through the gateway.

For example, an AWS public NAT gateway lets resources in private subnets initiate internet connections through an associated Elastic IP address and an internet gateway. AWS also supports private NAT gateways for other connectivity patterns.

For a business integration, the translated source address may be the one a partner needs to approve. The individual server’s private address is not necessarily visible to the partner. Retained address resources are explained in What Is a Reserved IP Address?.

Is NAT a firewall?

NAT and firewall filtering perform different jobs. NAT changes addresses; a firewall applies rules about which traffic is allowed.

Many devices combine both functions. A typical stateful NAT setup also lacks mappings for arbitrary unsolicited incoming connections, which can limit reachability. That does not make address translation a complete security policy, and NAT does not encrypt traffic.

RFC 4864 explains how network protection can be provided without relying on translation, including in IPv6 networks. Configure access controls for the actual services and connections you intend to allow.

Does IPv6 need NAT?

IPv6’s larger address space generally removes the address-scarcity reason for sharing a public address through NAT. Devices can use globally routable IPv6 addresses while a firewall controls incoming traffic.

Translation still has roles. NAT64, usually used with DNS64, lets IPv6-only clients communicate with IPv4 servers through a translator. It bridges protocol versions rather than simply sharing an IPv4 address among IPv4 devices. RFC 6146 defines this mechanism.

Read IPv4 vs IPv6 for more on how the two protocols coexist.

FAQ

Related resources