What Is NAT and How Does It Work?

How can your laptop, smartphone, smart TV, and gaming console all access the internet through one home router despite having different local IP addresses?

Often, the answer is Network Address Translation (NAT). In a typical home IPv4 network, the router uses source NAT with port translation so several devices can share one public IPv4 address. It tracks the resulting mappings so replies can return to the right device.

NAT is not the same as routing, a firewall, or a VPN. Knowing the difference helps explain both everyday connections and why some games or remote-access tools need extra configuration.

What Is NAT (Network Address Translation)?

Network Address Translation (NAT) is a networking function that changes IP address information in packets as they pass between network address spaces. Depending on the implementation, a translating device may change source addresses, destination addresses, or both. Some forms also translate transport-layer port numbers, such as TCP or UDP ports. The foundational terminology and traditional forms of NAT are described in RFC 2663 and RFC 3022.

To see why this matters, distinguish two common kinds of IPv4 address:

• Private IPv4 addresses are intended for use inside private networks. The ranges reserved for private use by RFC 1918 are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not globally routed across the public internet.
• Public IPv4 addresses are globally unique addresses that can be routed on the public internet, subject to routing and address-use policies. A router may receive one on its internet-facing interface, depending on the service and network arrangement.

For example, a laptop might use 192.168.1.10 at home while the router uses a different address on its internet-facing side. The router can translate the laptop's outgoing traffic so the remote server sees the router's public-side address, rather than the laptop's private address. Read more in Synth Visual's guide to public vs. private IP addresses; the broader topic of IP addressing is covered in What Is an IP Address?.

A simple analogy is a building with one street address and many apartment numbers. The street address helps outside visitors find the building, while the apartment number identifies the intended resident. This is only an analogy: actual NAT uses packet fields and, in many implementations, mappings involving IP addresses, ports, and protocol information.

NAT is not an internet connection or a type of IP address. It is also not a VPN. Different NAT designs and configurations behave differently, so not every NAT device translates the same fields or handles incoming traffic in the same way.

Why Is NAT Used?

The most familiar reason for NAT's wide use is IPv4 address conservation. IPv4 has a limited address space, and private addresses let many separate networks reuse the same ranges internally. A home router can then use source NAT with port translation to let multiple devices share a single public IPv4 address for many simultaneous connections. This use of Network Address Port Translation (NAPT) is described in RFC 3022.

NAT also makes internal addressing less dependent on external addressing: an organization can change its local network plan without assigning globally routable IPv4 addresses to every device.

There are trade-offs. NAT changes the original end-to-end address information and can make unsolicited inbound connections harder to establish. Applications that expect peers to connect directly may need techniques such as connection coordination or explicit port mappings. NAT has not eliminated IPv4 address scarcity; it helps conserve public addresses. IPv6 provides a vastly larger address space and changes the need for widespread address sharing, although IPv6 networks still require appropriate security policies.

How Does NAT Work? Step by Step

Consider a typical home-router setup using source NAT with port translation. The address values below are illustrative. In particular, 203.0.113.0/24 and 198.51.100.0/24 are reserved for documentation examples by RFC 5737; they are not real public addresses to use for live connections.

• Laptop private IPv4 address: 192.168.1.10
• Router's private LAN address: 192.168.1.1
• Router's illustrative public-side IPv4 address: 203.0.113.25
• Illustrative destination server address: 198.51.100.80
• Destination service: TCP port 443 (commonly used for HTTPS)

Here is what happens when the laptop opens a website:

1. The laptop starts a connection. It creates an outgoing packet with source IP 192.168.1.10, a temporary source port such as 51514, destination IP 198.51.100.80, and destination port 443.
2. The packet reaches the router. Because the destination is outside the laptop's local network, the laptop sends the packet to its default gateway, commonly the router at 192.168.1.1.
3. The router applies its NAT rule. In a typical home configuration, it changes the source IP to its public-side address. For PAT/NAPT, it also associates the flow with a source port on the public side; the example below uses 62001.
4. The router records the mapping. Its NAT state lets it associate the translated source address and port with the original internal connection.
5. The translated packet travels toward the server. The destination IP and destination port normally remain 198.51.100.80 and 443 during this ordinary outbound source translation.
6. The server replies. The reply is addressed to 203.0.113.25:62001, the translated public-side address and port shown in this example.
7. The router matches the mapping. It translates the reply's destination information back to the internal endpoint—192.168.1.10:51514 in this example—and forwards the packet to the laptop.

A simplified before-and-after view:

This is a conceptual example of a common stateful home-router design, not a universal description of all NAT. Actual port selection and mapping behavior depend on the implementation, protocol, and configuration. Translating address or port fields also requires the device to handle relevant packet checksums correctly.

Ports distinguish simultaneous connections sharing one public IPv4 address. A laptop and phone might both connect to destination port 443, while the router assigns different translated source ports so each reply reaches the right internal connection.

What Is a NAT Translation Table?

A NAT translation table—also called translation state or a mapping table—is the information a NAT device uses to relate an original connection to its translated representation. In a typical home router, an entry may associate an internal IP address and source port with a translated public-side address and port. Depending on the NAT type and implementation, it may also track the protocol, remote endpoint details, timers, and connection state.

A simplified conceptual entry might look like this:

This table is not necessarily a list of every device on the network. It represents mappings maintained by a particular NAT implementation, often for active or recently active traffic. When a reply arrives, the router can use the relevant mapping to forward it to the correct internal endpoint. Entries may expire after a period without matching traffic, according to the device's rules and the protocol involved.

Types of NAT

NAT terminology describes more than one dimension of translation. Static versus dynamic describes how mappings are assigned; source versus destination NAT describes which address information is changed; and PAT/NAPT adds port translation. These categories are not mutually exclusive.

A static mapping does not automatically make a service reachable from the internet in every environment. Traffic must have a viable route, and the relevant firewall rules and translation configuration must allow it. Similarly, dynamic NAT does not mean that many devices automatically share one address; a pool-based mapping and PAT/NAPT solve different address-use scenarios. RFC 3022 describes traditional NAT and NAPT, while RFC 2663 provides terminology and considerations.

NAT vs. a Firewall: What's the Difference?

NAT translates addressing information; a firewall enforces traffic policy. A firewall can allow, deny, or inspect traffic according to rules such as the direction of a connection, protocol, address, port, or application. Many consumer routers combine routing, NAT, and firewall features in one box, which can make the functions seem interchangeable.

NAT may affect inbound traffic because a router often has no mapping for an unsolicited packet arriving from the internet. But this behavior is not the same as a complete firewall policy, and NAT implementations do not all handle inbound traffic identically. Port forwarding or another explicit mapping may direct incoming traffic to an internal device, subject to routing and filtering rules.

Do not rely on NAT alone as a security strategy. Use suitable firewall settings, keep router and endpoint software updated, and secure accounts and services with strong authentication. Address translation does not patch vulnerable software or block every unwanted connection.

NAT vs. VPN: What's the Difference?

NAT and a Virtual Private Network (VPN) solve different problems. NAT rewrites selected addressing information as packets cross a translating device. A VPN creates a tunnel between endpoints; VPN software commonly encrypts traffic inside that tunnel and routes it through a VPN server or another private network, depending on its configuration.

When a consumer VPN sends internet traffic out through a provider's server, websites may see the VPN server's public IP address rather than the user's usual public-side address. This does not mean NAT has disappeared: the local router may still use NAT, and the VPN provider's network may use routing and address translation too. NAT does not inherently encrypt traffic, and VPN features and privacy properties vary by service and configuration.

For a separate explanation of the tunneling technology, read Synth Visual's guide to how a VPN works.

What Is Double NAT?

Double NAT occurs when traffic passes through two devices that both translate addresses. A common example is a home router connected to an ISP-provided gateway that is also acting as a router and performing NAT. The home router translates a device's private address, and the upstream gateway translates the home router's internet-bound traffic again.

Double NAT does not automatically break the internet. Browsing and many ordinary apps may work normally. However, inbound connections, port forwarding, some online gaming features, peer-to-peer applications, and remote-access setups can become more complicated because mappings may need to be configured across both devices.

To investigate, check the router's WAN address and whether an upstream gateway also performs NAT. Depending on the equipment and ISP, bridge mode or using one device as an access point may simplify the setup, but options vary. Follow the ISP's or manufacturer's instructions before changing settings.

What Is Carrier-Grade NAT (CGNAT)?

Carrier-Grade NAT (CGNAT) is NAT performed within an internet service provider's network to let multiple customers share public IPv4 addresses. Unlike a typical home-router NAT configuration, the customer generally does not manage the ISP's translation device. The requirements and trade-offs for CGN deployments are discussed in RFC 6888.

CGNAT can make unsolicited inbound connections, self-hosted services, remote access, and some port-forwarding scenarios more difficult because the customer may not control the upstream mapping. A port-forwarding rule on the home router alone may not be enough if an ISP-controlled NAT sits above it.

The address range 100.64.0.0/10—from 100.64.0.0 through 100.127.255.255—was reserved by RFC 6598 as Shared Address Space for provider networks. It is distinct from the private-use ranges in RFC 1918 and is not globally routable. Importantly, not every address beginning with 100. belongs to this range. The IANA IPv4 Special-Purpose Address Registry lists the block and its status.

To investigate possible CGNAT, compare your router's WAN address with the address seen by an external IP-checking service, then ask your ISP to confirm. A mismatch is a clue, not proof. The ISP can tell you whether a public IPv4 address or another inbound-access option is available.

How Does NAT Relate to IPv6?

IPv6 has a much larger address space than IPv4, so it does not need widespread NAT merely to conserve addresses. Devices can use globally unique addresses, while networks apply other protections. The IETF's RFC 4864, Local Network Protection for IPv6, discusses ways to protect local systems without relying on address translation.

That does not mean every IPv6 device is automatically reachable from the public internet. Routers and hosts can apply firewall policies that restrict unsolicited inbound traffic, and actual reachability depends on addressing, routing, filtering, and network configuration. IPv6 privacy addresses are another distinct feature: they can reduce the long-term linkability of an interface's address, but they are not a form of NAT and do not by themselves guarantee privacy or security.

NAT may still be used in some IPv6 deployments for particular purposes, but it is not universally required. IPv4 and IPv6 can also operate side by side, so one connection or home network may use different behavior for each protocol.

Common Misconceptions About NAT

• NAT and private IP addresses are different concepts. Private addresses can be used without NAT, and NAT is not limited to translating private addresses to public ones.
• NAT does not encrypt traffic or guarantee anonymity. Encryption requires a separate mechanism, and websites may still recognize accounts, cookies, or devices.
• NAT is not a complete firewall. Security depends on filtering rules and other controls.
• Devices sharing one public IPv4 address can still have different private addresses and distinct connection mappings.
• Port forwarding does not disable NAT. It configures a mapping for selected inbound traffic where routing and filtering permit it.
• NAT does not always prevent incoming connections, and IPv6 does not universally require NAT. Static mappings can allow inbound traffic; IPv6 networks can apply firewall policies without NAT for address conservation.

Frequently Asked Questions

Conclusion

NAT changes addressing information as traffic crosses a network boundary. In a typical home IPv4 network, source NAT with port translation lets multiple devices share one public IPv4 address, while mapping state helps replies reach the correct internal connection. Other forms of NAT support different mapping and service-publication needs.

The key distinction is that NAT translates addresses; routing forwards packets, firewalls enforce traffic policies, and VPNs create tunnels. Knowing which function is involved helps explain both how everyday connections work and why double NAT or CGNAT may complicate some inbound services. Continue learning with Synth Visual's guides to IP addresses, public vs. private IP addresses, and VPNs.

References

The following technical references were consulted for the protocol and address-range explanations in this article:

1. RFC 3022 — Traditional IP Network Address Translator (Traditional NAT). https://www.rfc-editor.org/rfc/rfc3022.html
2. RFC 2663 — IP Network Address Translator (NAT) Terminology and Considerations. https://www.rfc-editor.org/rfc/rfc2663.html
3. RFC 1918 — Address Allocation for Private Internets. https://www.rfc-editor.org/rfc/rfc1918.html
4. RFC 5737 — IPv4 Address Blocks Reserved for Documentation. https://www.rfc-editor.org/rfc/rfc5737.html
5. RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs). https://www.rfc-editor.org/rfc/rfc6888.html
6. RFC 6598 — IANA-Reserved IPv4 Prefix for Shared Address Space. https://www.rfc-editor.org/rfc/rfc6598.html
7. RFC 4864 — Local Network Protection for IPv6. https://www.rfc-editor.org/rfc/rfc4864.html
8. RFC 4787 — Network Address Translation (NAT) Behavioral Requirements for Unicast UDP. https://www.rfc-editor.org/rfc/rfc4787.html
9. IANA — IPv4 Special-Purpose Address Registry. https://www.iana.org/assignments/iana-ipv4-special-registry