Network Address Translation (NAT) is a method that routers use to map private IP addresses to a single public IP address, allowing multiple devices on your home or corporate network to share one internet connection while hiding their internal addresses from the public internet.
Every time you connect to the internet from home, your router's NAT function is working behind the scenes. Without NAT, we'd need a public IP address for every single device on the planet—and we'd run out quickly. NAT solved this problem decades ago, and it remains one of the most important networking technologies you'll encounter.
NAT sits at the boundary between your private network and the public internet. Its job is straightforward: when a device on your internal network sends data to the internet, NAT replaces the private source IP address with the router's public IP address. When responses come back, NAT reverses the process, routing data to the correct internal device.
Think of it like a company mailroom. Internal employees have desk numbers (private IPs), but mail from outside addresses is sent to the company's main address (public IP). The mailroom sorts incoming mail and delivers it to the right desk. That's NAT.
We need NAT because we're running out of IPv4 addresses. There are roughly 4.3 billion possible IPv4 addresses, but there are nearly 8 billion people on Earth. NAT lets thousands of devices share a single public address. It's also a security feature—your internal network topology stays hidden from external traffic, making it harder for attackers to probe your systems.
Let's walk through a concrete example. Say you have a laptop with the private IP 192.168.1.5 and your router has the public IP 203.0.113.45. You open a browser and request a webpage from 93.184.216.34 (example.com).
Outbound flow:
192.168.1.5 and sends it to the router203.0.113.45Inbound flow:
203.0.113.45:54321192.168.1.5The router maintains a NAT translation table (also called a state table) that tracks every active connection. This table maps internal addresses and ports to external ports, allowing the router to know which device should receive incoming responses.
Static NAT creates a permanent, one-to-one mapping between a private IP and a public IP. If your internal server has IP 192.168.1.10, you might configure static NAT to always map it to public IP 203.0.113.50.
Static NAT is useful when you're hosting a service that needs a consistent, reachable address from the internet—like a web server or mail server. However, you need multiple public IPs to use static NAT, which is expensive. Most organizations reserve static NAT for critical services only.
Dynamic NAT assigns temporary mappings from a pool of public IPs. If you have five public IPs and 50 internal devices, NAT hands out public IPs from the pool on demand. When a connection closes, that public IP returns to the pool for reuse.
Dynamic NAT is more efficient than static NAT because it multiplexes many devices across fewer public addresses. However, it still requires multiple public IPs—you're just sharing them across your internal network.
PAT (also called NAT Overload) is what most home routers use. It maps many internal addresses to a single public IP by using different port numbers. This is the most efficient form of NAT and requires only one public address, regardless of how many internal devices you have.
When you access the internet from home, you're almost certainly using PAT. The router assigns each connection a unique port number, allowing it to track hundreds or thousands of simultaneous connections through a single public IP.
# Example: PAT translation table entry
Internal: 192.168.1.5:51234 → External: 203.0.113.45:54321
Internal: 192.168.1.8:51235 → External: 203.0.113.45:54322
Internal: 192.168.1.12:51236 → External: 203.0.113.45:54323
NAT creates a problem for inbound connections. When someone external tries to reach your internal network, how does the router know which internal device should handle the request? By default, it doesn't—inbound connections are blocked.
This is where port forwarding comes in. Port forwarding is a manual override that tells the router: "Any traffic arriving on port 8080 should be sent to 192.168.1.10:80." This lets you host services internally while making them accessible from the internet.
Most routers expose port forwarding in their admin interface. You specify an external port, an internal IP, and an internal port, and the router maintains that mapping permanently.
# Port forwarding example
External port 8080 → Internal IP 192.168.1.10, Internal port 80
External port 25 → Internal IP 192.168.1.20, Internal port 25
Breaks peer-to-peer applications: Services that need inbound connections (like video conferencing, gaming, or file sharing) struggle with NAT. Both peers are behind NAT and can't initiate inbound connections, so they often can't reach each other directly. This is why many applications use STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT) servers to punch through NAT barriers.
Complicates network troubleshooting: Network diagnostics become harder when internal addresses are hidden behind NAT. Traceroute, ping, and other tools show only the router, not the internal topology.
Connection state management: The router's NAT table has finite memory. If a device sends millions of connection requests without cleaning up old entries, the table can overflow and the router may start dropping connections.
Fragmentation issues: Some firewalls performing NAT also perform packet inspection, which can corrupt packets if fragmentation occurs. Modern systems handle this better, but it's still a known issue.
IPv6 offers 340 trillion trillion addresses—more than enough for every device on the planet and beyond. In theory, IPv6 eliminates the need for NAT because every device can have a globally routable address.
However, IPv6 adoption has been slow. Many ISPs don't offer it, many networks aren't equipped to handle it, and switching infrastructure is expensive. So NAT remains relevant and will likely continue to be used even as IPv6 grows.
Some organizations are experimenting with "IPv6-only" networks, but most enterprises still maintain dual-stack (IPv4 and IPv6) for years to come. For now, NAT is here to stay.
If you're on Linux or macOS and want to see NAT in action, you can inspect your routing table and connection states. Most users won't need to do this, but network professionals often check NAT configurations on routers and firewalls.
# View routing table on Linux
ip route show
# View active connections and their states
netstat -an | grep ESTABLISHED
# On Windows, check NAT rules (requires admin)
netsh int ipv4 show nat
On your home router, you'll typically find NAT settings in the admin panel under "Network," "Advanced," or "NAT Settings." Most routers have NAT enabled by default with no configuration needed.
Understanding NAT is crucial for anyone working with networks. Whether you're configuring a home lab, troubleshooting connectivity issues, or designing enterprise networks, NAT concepts come up constantly. The translation model is simple, but the implications are profound—it's one of the reasons we haven't run out of IP addresses yet.
Want to dive deeper? Check out our guides on routing fundamentals, firewall basics, and IPv6 addressing to understand how NAT fits into the broader networking ecosystem.
NAT blocks inbound connections by default for security. The router doesn't know which internal device should handle incoming traffic. You need to set up port forwarding to allow external access to a specific internal service. Some routers also have UPnP (Universal Plug and Play) enabled, which allows applications to request port forwarding automatically, but this is less secure.
Not significantly. NAT operates at line-rate on modern routers—the address translation happens in dedicated hardware and adds negligible latency. You might notice a few milliseconds of extra delay on the first packet of a connection while the router sets up the translation entry, but sustained throughput is unaffected. If your internet is slow, NAT isn't the culprit.
Most home routers have NAT enabled permanently and don't allow you to disable it. Some advanced routers and firewalls let you disable NAT, but then your internal network becomes directly exposed to the internet, which is a serious security risk. Even if your ISP assigns you a public IP, you should keep NAT enabled as a security layer.
When the NAT table overflows, the router typically starts dropping new connection requests or recycling old entries. On heavily loaded networks or routers with insufficient memory, this can cause connectivity issues or timeouts. Enterprise-grade equipment has larger NAT tables and better aging algorithms to handle this, while consumer routers may struggle under extreme load.