NAT
Rewriting addresses (and usually ports) so many hosts share a public IP.
Level: intermediate
What is it?
Network Address Translation (NAT) modifies network-layer addresses in packet headers; common home/enterprise port-address translation also rewrites transport ports so many private hosts can share a public IPv4 address. Stateful translation keeps mappings so return traffic can be associated with the right internal endpoint.
Why does it matter?
NAT conserves public IPv4 address space and enables private networks to initiate outbound connections through a gateway. It complicates end-to-end reachability, troubleshooting, protocols that embed addresses, and inbound connections that need explicit mappings.
Mental model
A gateway maintains a translation table: an outbound packet is rewritten and recorded; the reply matches that state and is rewritten back to the private endpoint.
How it works
- NAT is not a complete security policy; firewall rules and state tracking are separate concerns.
- Port-address translation distinguishes concurrent flows that share the same public address.
- Unsolicited inbound traffic may have no mapping and will commonly be dropped unless forwarding rules or a related connection authorize it.
- NAT can complicate peer-to-peer and real-time communication, which may use discovery/relay techniques.
- IPv6 reduces the address-scarcity pressure that made NAT ubiquitous, but firewalling and network policy still remain necessary.
Steps
- A private host sends a packet to a public server.
- The gateway replaces the source private IP and often source port with a public mapping.
- The server replies to the public tuple stored in the translation state.
- The gateway maps the reply to the original internal IP and port.
Real-world usage
- Troubleshooting a home router and port forwarding.
- Explaining why an outbound connection works but an unsolicited inbound connection does not.
- Distinguishing NAT from firewalling and authorization.
Common mistakes
- Saying NAT automatically makes a network secure.
- Assuming port forwarding changes the application's authentication requirements.
- Confusing NAT table state with the IP routing table.
Interview questions
Why can many private hosts share one public IPv4 address?
Port-address translation maps each outbound flow to a distinct public address/port tuple and tracks it for return traffic.
Is NAT the same as a firewall?
No. NAT rewrites addresses and often ports; a firewall makes allow/deny decisions. Many gateways combine both functions.