What Is NAT (Network Address Translation)?

The Problem NAT Solves: IPv4 Exhaustion

An IPv4 address is a 32-bit number, which means there are only about 4.3 billion of them in total. That sounded like plenty in the early days of the internet, but with billions of phones, computers, servers, and smart devices online, the world simply ran out of unique public IPv4 addresses.

To cope, engineers set aside blocks of 'private' addresses (the familiar 10.x.x.x, 172.16.x.x–172.31.x.x, and 192.168.x.x ranges) that anyone can reuse inside their own network. The catch is that private addresses are not allowed to travel across the public internet, so a device using one cannot talk to the outside world on its own.

NAT is the bridge. It translates a private inside address into a routable public address on the way out, and translates the reply back on the way in, so a whole network of private devices can share the internet through one or a few public IPs.

Inside vs. Outside: The Translation Boundary

NAT thinks in terms of an inside (your private network) and an outside (the public internet). The router sits on the boundary between them and is the only device that performs the address rewriting.

In Cisco terms you will hear 'inside local' (the private address a host really uses) and 'inside global' (the public address the outside world sees it as). You do not need to memorize every label yet; the key idea is that one real private device is presented to the internet under a different, public identity.

To keep replies flowing to the right device, the router maintains a translation table that records each mapping. When a response comes back from the internet, the router looks up the table and rewrites the destination address so the packet reaches the correct inside host.

Three Flavors: Static NAT, Dynamic NAT, and PAT

Static NAT is a fixed one-to-one mapping: one private address is always translated to the same public address. This is useful when an inside device, such as a web or mail server, must be reliably reachable from the outside at a known public address.

Dynamic NAT draws from a pool of public addresses and hands them out on demand, still one-to-one but temporarily. A host borrows a public address for its conversation and returns it to the pool afterward. If the pool runs dry, additional hosts have to wait.

PAT (Port Address Translation), also called NAT overload, is the version almost everyone actually uses, including every home router. It maps many private hosts onto a single public IP and tells their conversations apart by assigning each one a unique TCP or UDP port number. Because those port numbers give it thousands of combinations to work with, one public address can serve a large network at once.

A Simple Analogy for PAT

Picture an apartment building with one street address but many apartments. Mail leaving the building all shows the same street address (the public IP), but the mailroom writes a unique apartment number (the port) on each outgoing letter and keeps a log of who sent what.

When replies arrive addressed to the building's street address plus a specific apartment number, the mailroom checks its log and delivers each one to the correct apartment. That log is exactly what a router's NAT translation table does, and the apartment numbers are the port numbers that let one public IP stand in for many private hosts.

What NAT Does and Does Not Do for Security

NAT has a helpful side effect: because inside hosts are not directly addressable from the internet, unsolicited inbound traffic has no matching entry in the translation table and is simply dropped. That makes NAT feel protective, and it does reduce a network's exposure.

But NAT is not a firewall and should never be treated as your security policy. It does not inspect packet contents, does not filter what your own users send outbound, and does not stop malware, phishing, or attacks that ride along inside connections your devices initiated. The moment you add static NAT or 'port forwarding' to publish an inside server, you have deliberately opened a path straight to it.

Real filtering is the job of a stateful firewall and access control lists (ACLs), which decide what traffic is allowed based on addresses, ports, and connection state. Think of NAT's privacy benefit as a byproduct, not a defense you rely on.

Common Beginner Gotchas

The biggest one is the security confusion above: 'I'm behind NAT, so I'm safe.' Being hard to reach is not the same as being protected. Pair NAT with an actual firewall.

Do not mix NAT up with related tools. DHCP hands out IP addresses to devices; subnetting divides an address block into smaller networks; NAT translates addresses at the internet edge. They often run on the same router but solve different problems.

Finally, know that NAT can complicate protocols that embed IP addresses inside their own data (some voice, gaming, and older peer-to-peer applications), which is why features like port forwarding exist as workarounds. IPv6, with its enormous address space, was designed to make this kind of address-sharing largely unnecessary, but as long as the IPv4 internet endures, NAT remains everywhere. When you are ready to configure it, our step-by-step how-to guide walks through the actual commands.