Free lesson · Computer Networking
Nat Network Address Translation
The Workaround That Saved IPv4
By the mid-1990s, it was clear that the IPv4 address space was being consumed faster than anticipated. IPv6 was being developed but was years from deployment. The internet needed a bridge technology that could extend IPv4's lifespan by reducing the number of public IP addresses required. That technology was NAT (Network Address Translation).
NAT allows multiple devices on a private network to share a single public IP address. Your home network might have 20 devices - laptops, phones, tablets, smart TVs, IoT sensors - each with a private IP address in the 192.168.x.x range. But your ISP assigns your home only one public IP address. NAT, running on your home router, translates between the private addresses used internally and the single public address used externally. From the internet's perspective, all 20 of your devices appear to be a single device with one IP address.
NAT was designed as a temporary measure until IPv6 was widely deployed. Three decades later, IPv6 adoption is still incomplete, and NAT remains one of the most widely deployed networking technologies on the planet. Every home router, every corporate firewall, and most cloud NAT gateways perform network address translation.
How NAT Works
NAT operates at the boundary between a private network and the public internet - typically on a router or firewall. The NAT device maintains a translation table that maps internal (private) addresses to external (public) addresses.
The Basic Translation Process
When an internal device sends a packet to the internet:
- The device creates a packet with source IP
192.168.1.10and destination IP93.184.216.34(some web server) - The packet reaches the NAT router
- The router replaces the source IP
192.168.1.10with its own public IP73.42.15.99 - The router records the translation in its table:
192.168.1.10:54321 ↔ 73.42.15.99:54321 - The modified packet is sent to the internet with source
73.42.15.99
When the response comes back:
- The web server sends a response to
73.42.15.99(the NAT router's public IP) - The NAT router receives the response and checks its translation table
- It finds the mapping and replaces the destination IP
73.42.15.99with192.168.1.10 - The response is delivered to the correct internal device
The key insight is that the NAT router rewrites packet headers - changing source addresses on outgoing packets and destination addresses on incoming packets - while keeping the translation table so it can match responses to the original requests.
sequenceDiagram
participant D as Laptop<br/>192.168.1.10
participant NAT as NAT Router<br/>Private: 192.168.1.1<br/>Public: 73.42.15.99
participant S as Web Server<br/>93.184.216.34
D->>NAT: Src: 192.168.1.10:54321<br/>Dst: 93.184.216.34:443
Note over NAT: Translate source:<br/>192.168.1.10:54321<br/>→ 73.42.15.99:54321<br/>Record in NAT table
NAT->>S: Src: 73.42.15.99:54321<br/>Dst: 93.184.216.34:443
S->>NAT: Src: 93.184.216.34:443<br/>Dst: 73.42.15.99:54321
Note over NAT: Lookup NAT table:<br/>73.42.15.99:54321<br/>→ 192.168.1.10:54321
NAT->>D: Src: 93.184.216.34:443<br/>Dst: 192.168.1.10:54321
This sequence diagram shows how NAT translates addresses. The laptop at 192.168.1.10 sends a packet to the web server at 93.184.216.34. The NAT router rewrites the source address from the private 192.168.1.10 to its public address 73.42.15.99 and records the mapping. The web server sees the request as coming from 73.42.15.99 and sends its response there. The NAT router receives the response, looks up the mapping in its table, and rewrites the destination back to 192.168.1.10, delivering the response to the correct internal device.
Types of NAT
Static NAT (One-to-One)
Static NAT creates a permanent, fixed mapping between one private IP and one public IP. Device 192.168.1.10 always maps to 73.42.15.100, and that mapping never changes. Static NAT is used when an internal server needs to be consistently reachable from the internet at a known public address - for example, a mail server or a web server hosted behind a NAT device.
Static NAT does not save addresses - each internal device still consumes one public IP. Its primary purpose is providing consistent address mapping, not address conservation.
Dynamic NAT (Many-to-Many)
Dynamic NAT maps internal devices to public addresses from a pool, but the mapping is not permanent. When an internal device initiates a connection, the NAT device assigns it an available public address from the pool. When the connection ends, the public address is returned to the pool for reuse.
Dynamic NAT saves addresses only if there are fewer simultaneous connections than pool addresses. If the pool has 10 public addresses and 100 internal devices, it works as long as no more than 10 are communicating simultaneously. If the pool is exhausted, additional connection attempts fail.
PAT / NAPT (Many-to-One) - The Most Common Form
PAT (Port Address Translation), also called NAPT (Network Address Port Translation) or often just "NAT" in casual usage, is by far the most common form. It maps many internal devices to a single public IP address by using port numbers to distinguish between connections.
When device A at 192.168.1.10 connects to a web server, the NAT router records the mapping: 192.168.1.10:54321 → 73.42.15.99:54321. When device B at 192.168.1.11 connects to a different server, the mapping is: 192.168.1.11:49888 → 73.42.15.99:49888. Both devices share the same public IP, but the different port numbers allow the NAT router to distinguish which response belongs to which device.
Since port numbers are 16-bit values (0-65535), a single public IP address can theoretically support about 65,000 simultaneous connections through PAT. In practice, the limit is lower due to ephemeral port range restrictions (most OSes use ports 49152-65535, giving about 16,000 ephemeral ports), memory for the translation table, and the fact that each unique combination of destination IP and port can reuse the same source port. Modern NAT devices track connections by the full 5-tuple (source IP, source port, destination IP, destination port, protocol), which means the effective limit is much higher than the simple port count suggests - a single public IP can support hundreds of thousands of simultaneous connections to different destinations.
PAT is what your home router does. It is also what AWS NAT Gateways, Azure NAT Gateways, and GCP Cloud NAT do - they allow private instances in a VPC to access the internet through a shared public IP address using port-based multiplexing.
Connection Tracking and Timeouts
NAT devices must track every active connection to correctly route return traffic. Each entry in the NAT translation table includes a timeout - TCP connections typically have a 24-hour timeout (reset with each packet), while UDP mappings have much shorter timeouts (often 30-120 seconds) because UDP has no connection state to indicate when communication is finished.
These timeouts matter for application design. A long-lived TCP connection that goes idle (no packets for the timeout period) will have its NAT mapping silently removed. When the application tries to send data again, the packet will either be dropped or receive a RST response. This is why many protocols implement keep-alive mechanisms - TCP keepalives, HTTP keep-alive headers, or application-level heartbeats - to prevent NAT timeout from killing idle connections. This is a common source of "connection dropped" bugs in production systems.
NAT and Its Implications for Application Design
NAT was designed to be transparent - applications should not need to know they are behind NAT. In practice, NAT creates significant complications for certain types of applications.
The Inbound Connection Problem
NAT works naturally for outbound connections (internal device initiates contact with the internet) because the NAT table is populated when the internal device sends the first packet. But inbound connections - where an external device tries to initiate contact with an internal device - fail by default because there is no entry in the NAT table mapping the external request to an internal device.
This is why you cannot simply run a web server on your laptop and have the world access it by your home IP. The NAT router does not know which internal device should receive the incoming connection. Solutions include:
Port forwarding: Manually configuring the NAT router to forward traffic on a specific port to a specific internal device. "Forward port 80 on the public IP to 192.168.1.10:80." This is the simplest solution but requires manual configuration and a fixed internal address.
UPnP (Universal Plug and Play): Applications can automatically request port forwarding from the NAT router. Used by gaming consoles and P2P applications. Considered a security risk because any application on the network can open ports without user approval.
NAT traversal techniques (STUN/TURN/ICE): Used by WebRTC, VoIP, and gaming. These protocols discover the public IP and port mapping created by NAT and share this information with the remote peer, enabling direct communication. When direct connection is impossible (some NAT types do not allow it), a TURN relay server mediates the connection.
Impact on Peer-to-Peer Applications
P2P applications like video calling, file sharing, and multiplayer gaming are fundamentally affected by NAT because both peers may be behind separate NAT devices, neither of which has a mapping for the other. Establishing a direct connection requires NAT traversal - a complex negotiation process that does not always succeed.
WebRTC, the standard for browser-based video and voice calling, uses the ICE (Interactive Connectivity Establishment) framework to handle NAT traversal. ICE tries multiple connection methods in order: first a direct connection (if both peers are on the same network), then STUN (using a third-party server to discover public addresses and NAT mappings), and finally TURN (relaying traffic through a server when direct connection is impossible). The complexity of ICE reflects the fundamental difficulty of establishing peer-to-peer connections in a world full of NAT devices.
graph TD
subgraph NATTypes["NAT Types and Their Behavior"]
direction TB
STATIC["Static NAT<br/>1 private → 1 public<br/>Permanent mapping<br/>Allows inbound"]
DYNAMIC["Dynamic NAT<br/>Many private → pool of public<br/>Temporary mapping<br/>Pool exhaustion risk"]
PAT["PAT / NAPT<br/>Many private → 1 public<br/>Port-based multiplexing<br/>Most common form"]
end
style STATIC fill:#4f46e5,stroke:#4338ca,color:#fff
style DYNAMIC fill:#7c3aed,stroke:#6d28d9,color:#fff
style PAT fill:#8b5cf6,stroke:#7c3aed,color:#fff
This diagram shows the three types of NAT. Static NAT maps one private address to one public address with a permanent mapping that allows inbound connections. Dynamic NAT maps many private addresses to a pool of public addresses with temporary mappings, but risks pool exhaustion. PAT or NAPT maps many private addresses to a single public address using port numbers to distinguish connections, and is the most common form used in home routers and cloud NAT gateways.
NAT as an Accidental Security Layer
NAT was not designed as a security feature, but it provides one by accident: because inbound connections fail by default (no NAT table entry exists), devices behind NAT are shielded from unsolicited incoming traffic. An attacker scanning the internet for vulnerable devices cannot reach a machine behind NAT unless port forwarding is configured for that machine.
However, relying on NAT as a firewall is considered poor security practice. NAT does not inspect packet contents, does not detect malicious traffic, and does not log connection attempts. A proper stateful firewall - which most NAT devices also include - provides actual security controls. NAT provides obscurity (hiding internal addresses), not security (enforcing access policies).
Double NAT - When NAT Happens Twice
Double NAT occurs when a device is behind two layers of NAT. This typically happens when an ISP uses Carrier-Grade NAT (CGNAT) and the customer also has a home router performing NAT. The customer's device has a private address (192.168.x.x), the home router translates it to the ISP-assigned address (often in the 100.64.x.x CGNAT range), and the ISP's CGNAT translates it again to a public IP.
Double NAT causes problems for applications that depend on port forwarding or NAT traversal. Port forwarding configured on the home router maps to the ISP-assigned address, but that address is not publicly reachable - it is behind another layer of NAT at the ISP. This effectively makes it impossible to host servers, use certain VPN configurations, or establish certain types of peer-to-peer connections. Double NAT is a growing problem as ISPs adopt CGNAT to conserve their dwindling IPv4 address pools.
NAT in the Cloud
Cloud providers implement NAT at infrastructure scale:
AWS NAT Gateway: A managed PAT service that allows instances in private subnets to access the internet for software updates, API calls, and external service communication without having public IP addresses. The NAT Gateway handles the translation, scaling, and high availability automatically. It is one of the most commonly provisioned networking resources in AWS, and it is priced per hour plus per gigabyte of data processed - which can add up significantly for workloads with heavy outbound traffic to external APIs or data sources.
Elastic IP / Public IP: AWS assigns a public IP (optionally a static Elastic IP) to instances that need direct inbound access. This is essentially a one-to-one static NAT mapping managed by the cloud provider's networking layer. Elastic IPs remain associated with your account even when detached from an instance, providing a stable public address for services that need a fixed IP for DNS, whitelisting, or partner integrations.
The design pattern of placing application servers in private subnets (no public IPs) with internet access via a NAT Gateway is the standard security best practice in cloud architecture. Only load balancers and bastion hosts sit in public subnets with direct internet-facing addresses.
Interview: NAT appears in System Design interviews in practical ways:
"Why are your application servers in a private subnet?" - Security. They do not need inbound connections from the internet - the load balancer handles that. They use a NAT gateway for outbound connections (software updates, calling external APIs).
"How does a NAT Gateway affect performance?" - Each NAT Gateway has throughput limits (typically 45 Gbps on AWS). If your workload generates heavy outbound traffic, you may need multiple NAT Gateways across AZs. NAT also adds a small latency overhead per packet for the translation lookup.
"Why is my peer-to-peer feature not working in production?" - NAT is the most common cause. Devices behind NAT cannot accept inbound connections without port forwarding or NAT traversal. WebRTC's ICE/STUN/TURN framework exists specifically to solve this problem.
What Comes Next
The next topic covers DHCP - the protocol that automatically assigns IP addresses to devices when they join a network. DHCP is what gives your laptop its 192.168.x.x address when you connect to Wi-Fi, and understanding its mechanics explains how devices bootstrap their network configuration.
Exercise: Starter: Log into your home router's admin page (usually 192.168.0.1 or 192.168.1.1). Find the NAT or port forwarding section. Can you see any active NAT translations? Some routers show a "NAT table" or "active connections" list that shows the internal IP, internal port, external port, and destination for each active connection.
Intermediate: Set up a simple web server on your local machine (
python3 -m http.server 8080). Try accessing it from another device on your local network using your machine's private IP. Then try accessing it from outside your network using your public IP. It will fail without port forwarding. Configure port forwarding on your router to forward port 8080 to your machine's private IP, and try again.Advanced: Research the different NAT types defined by RFC 4787: Full Cone, Restricted Cone, Port Restricted Cone, and Symmetric NAT. How does each type affect peer-to-peer connectivity? Why is Symmetric NAT the most difficult for NAT traversal? How do STUN and TURN handle each type? Most home routers use Port Restricted Cone NAT - verify this using a STUN client or online NAT type checker.