Skip to content
Networking Foundations

Module 7: Network Address Translation (NAT)

The private Internet Protocol version 4 (IPv4) address on your computer cannot be routed across the public internet. On a typical IPv4 network, a router, firewall, or software service replaces that address with one that can be routed publicly before sending the packet onward.

That replacement is network address translation (NAT).

In This Module

Section titled “In This Module”
  • What NAT changes in a packet
  • How translation state lets private hosts share an address and receive replies
  • Why inbound connections require configuration
  • Why NAT and firewall filtering are different

What Performs NAT?

Section titled “What Performs NAT?”

NAT is a networking function, not a particular type of device. It can be performed by:

  • A home or business router
  • A firewall
  • A cloud networking service
  • Virtualization or container software

Some products and cloud services use the name NAT gateway. The term is not limited to cloud networking, but it can sound like the name of one specific product. This module uses NAT device for any device or software service performing the translation.

One Outbound Request

Section titled “One Outbound Request”

Imagine a laptop opening a website.

Device or interface IPv4 address Address type
Laptop requesting the website 10.0.20.15 Private
NAT device’s inside interface, which is the laptop’s default gateway 10.0.20.1 Private
NAT device’s outside, internet-facing interface 198.51.100.20 Public
Web server hosting the website 198.51.100.80 Public

In this example, a router is performing NAT. The router is also the laptop’s default gateway and connects the private network to the public internet. Its inside interface uses a private address, while its outside interface uses a public address.

The laptop creates a packet with these IPv4 addresses:

Source IPv4 address (laptop):          10.0.20.15
Destination IPv4 address (web server): 198.51.100.80

Because the server is outside the local subnet, the laptop sends the packet to its default gateway at 10.0.20.1. Before forwarding it to the internet, the router performing NAT replaces the laptop’s private source address with the public address of its outside interface, 198.51.100.20.

IPv4 packet field Before NAT After NAT
Source IPv4 address 10.0.20.15 (laptop) 198.51.100.20 (NAT device’s outside interface)
Destination IPv4 address 198.51.100.80 (web server) 198.51.100.80 (web server)

The source changed. The destination stayed the same.

The web server now sees the request as coming from the NAT device’s public address, 198.51.100.20, and sends its reply there. It never sees the laptop’s private address, 10.0.20.15.

How the Reply Gets Back

Section titled “How the Reply Gets Back”

The reply reaches the NAT device, not the laptop directly. The NAT device must remember which private device started the request.

It stores a temporary record when the outbound connection begins. When the reply arrives, the NAT device uses that record to change the destination from its public address back to the laptop’s private address and forwards the packet to the laptop.

Outbound packet: Laptop (10.0.20.15) -> NAT device -> Web server (198.51.100.80)
Reply packet:    Web server (198.51.100.80) -> NAT device -> Laptop (10.0.20.15)

This works easily for one device. A NAT device may handle many connections at the same time, so it also uses port numbers to keep them separate.

Sharing One Public Address

Section titled “Sharing One Public Address”

Port numbers identify individual network conversations. Module 8 covers them in detail. For now, read 10.0.20.15:51514 as Internet Protocol (IP) address 10.0.20.15 using port 51514.

For the laptop’s Hypertext Transfer Protocol Secure (HTTPS) connection, the complete address-and-port translation might be:

HTTPS normally uses the Transmission Control Protocol (TCP).

Laptop’s private source NAT device’s translated public source Web server destination
10.0.20.15:51514 198.51.100.20:40001 198.51.100.80:443
  • 10.0.20.15:51514 is the laptop’s private IPv4 address and temporary source port.
  • 198.51.100.20:40001 is the NAT device’s public IPv4 address and translated source port.
  • 198.51.100.80:443 is the web server’s public IPv4 address and HTTPS destination port.

The NAT device keeps a temporary record connecting the private source with the translated public source. A reply sent to 198.51.100.20:40001 can then be translated and delivered to the laptop at 10.0.20.15:51514.

These records are commonly grouped in a translation table or NAT table. Depending on the product, they may instead appear in a session table or connection-tracking table. The name and implementation vary, but the purpose is the same: retain enough information to translate returning traffic correctly.

The NAT device can give another client a different public port:

Private client and source port NAT device’s public address and translated port
Laptop: 10.0.20.15:51514 NAT device: 198.51.100.20:40001
Second client: 10.0.20.25:51514 NAT device: 198.51.100.20:40002

Both clients share one public address, but the different public ports keep their replies separate.

This address-and-port translation is formally called Network Address Port Translation (NAPT), and is also commonly called Port Address Translation (PAT). In everyday conversation, people usually call the entire process NAT.

Translation entries are temporary. The NAT device removes an entry after its connection ends or remains idle long enough.

Why Inbound Is Different

Section titled “Why Inbound Is Different”

Outbound traffic creates a translation entry automatically. Unrequested inbound traffic has no entry.

Suppose a new connection arrives with this destination:

Destination IPv4 address (NAT device's public address): 198.51.100.20
Destination TCP port (HTTPS):                           443

The NAT device may represent dozens of private hosts. Without a rule, it cannot know whether to send the connection to the laptop at 10.0.20.15, the second client at 10.0.20.25, another private device, or a service on the NAT device itself.

This is why inbound connections require an explicit mapping.

NAT Is Not a Firewall

Section titled “NAT Is Not a Firewall”

NAT and firewall filtering are commonly performed by the same router or firewall, but they are different functions.

  • NAT changes source or destination addresses and sometimes port numbers.
  • A firewall decides whether traffic is allowed to pass.

Traditional outbound NAT makes unsolicited inbound connections difficult because they have no translation entry. That is useful behavior, but it does not inspect whether an allowed connection is safe. Module 12 covers filtering directly.

Common Places You Will See NAT

Section titled “Common Places You Will See NAT”
  • Home routers let many devices share one public IPv4 address.
  • Cloud NAT services give private virtual machines outbound access.
  • Container platforms translate traffic between container and host networks.
  • Virtual private network (VPN) gateways may translate traffic when connected networks use overlapping addresses.

NAT also affects logs. A public server normally records the translated public source address, not the private address of the client that started the connection.

Double NAT and Carrier-Grade NAT

Section titled “Double NAT and Carrier-Grade NAT”

Double NAT means traffic is translated twice. A virtual machine behind a home router is a common example: the virtualization platform translates the virtual machine’s address first, and the home router translates it again before the packet reaches the internet.

Outbound traffic usually still works. Inbound access is harder because each layer performing NAT may need its own port-forwarding rule.

Carrier-grade network address translation (CGNAT) is NAT performed by an internet provider. It lets many customers share public IPv4 addresses. Because the customer does not control the provider’s NAT service, ordinary inbound port forwarding may not be available.

When an inbound service fails despite a correct local port forward, check whether another router or CGNAT exists upstream.

Try It Yourself

Section titled “Try It Yourself”

Compare the IPv4 address assigned to your computer with the public source address seen by an external service.

On Windows, display the IPv4 addresses assigned to the computer:

ipconfig

Then display the public source IPv4 address seen by ipify:

curl https://api.ipify.org

On Linux, display the IPv4 addresses assigned to the computer:

ip -4 addr

Then display the public source IPv4 address seen by ipify:

curl https://api.ipify.org

On macOS, display the addresses assigned to the computer:

ifconfig

Then display the public source IPv4 address seen by ipify:

curl https://api.ipify.org

Compare the active network interface’s IPv4 address from the first command with the single public address printed by the second command. If they differ, NAT is the usual reason. On a typical home network, the first translation occurs at the home router. A VPN or web proxy can also change the address seen by the service.

The public address check sends a normal HTTPS request to ipify. Like any external service you contact, ipify can see the public address from which the request arrived.

Optional: Port Forwarding

Section titled “Optional: Port Forwarding”

A port forward is an explicit inbound mapping from an address and port on a NAT device to an address and port on a private system. It supplies the destination that unsolicited inbound traffic otherwise lacks.

Creating the translation is only one part of publishing a service. Routing, firewall rules, listening state, authentication, patching, and upstream NAT can all affect whether the service is reachable and safe.

The optional Port Forwarding and a Local-Only Lab appendix explains destination translation, container port publishing, and a VirtualBox exercise bound only to the Windows host’s loopback address.

Further Learning

Section titled “Further Learning”

Main Takeaways

Section titled “Main Takeaways”
  • Network address translation (NAT) changes address information, and often port information, as traffic crosses a network boundary.
  • A NAT device or service keeps temporary translation records so replies return to the correct private device and connection.
  • NAT and firewall filtering are separate functions.

Continue to Module 8: Transport, Ports, and Sockets to see how TCP, User Datagram Protocol (UDP), ports, and sockets identify individual conversations.