What Is NAT? Network Address Translation Explained

Network address translation, or NAT, is the quiet workhorse behind your internet connection. It lets your whole home go online through a single public IP address. Almost every router runs it. Yet most people never notice it working.

NAT is also the reason two ideas you may already know fit together. Private IP addresses are useful because NAT can translate them. IPv4 survived its address shortage because NAT stretched a tiny pool across billions of devices.

This guide explains what NAT does and the main types. It also covers carrier-grade NAT and whether IPv6 finally makes NAT obsolete.

What is NAT (network address translation)?

Network address translation is a router function that rewrites the IP addresses inside packet headers as traffic crosses between networks. It maps many private addresses onto one or more public addresses. That lets internal devices share limited public IP space while still reaching the internet.

The router sits at the boundary between two worlds. On the inside is your private network, full of addresses that mean nothing on the public internet. On the outside is the internet, which only routes public addresses. NAT is the translator that lets the two sides talk.

A useful analogy is a company switchboard. Every outbound call shows the company’s main number, and the operator routes each incoming reply to the right extension. NAT does the same with one public IP and many private devices.

Every device on your home network has a private address, handed out by your router. If you want a refresher on how those addresses get assigned, see our guide on how DHCP works. NAT is what turns those private addresses into something the wider internet can answer.

Why does NAT exist?

NAT exists because IPv4 ran out of addresses. The protocol allows about 4.3 billion addresses (2³²), far fewer than the world now needs. NAT lets a network hide thousands of devices behind one public address. That stretched the IPv4 pool long past its expected limit.

The private ranges NAT relies on come from RFC 1918. Three blocks are set aside for internal use and never routed on the public internet:

• 10.0.0.0/8 — over 16 million addresses, common in large networks.
• 172.16.0.0/12 — a mid-sized range often used in business setups.
• 192.168.0.0/16 — the familiar home-router range.

Without NAT, every phone, laptop, and smart bulb would need its own public address. There are not enough to go around. The real long-term fix is IPv6, which we cover in IPv4 vs IPv6. But NAT is what kept IPv4 alive in the meantime.

How NAT works: the translation table

NAT works by keeping a translation table. When a device sends out traffic, the router swaps the private source address for its public one. It records the mapping. When the reply returns, the router looks up the entry and swaps the address back. The packet reaches the right device.

The trick that makes one public IP serve a whole network is the port number. The router assigns each outbound connection a unique source port on the public address. That port is how it tells replies apart when they all arrive at the same public IP.

Here is the path a single packet takes on a typical home connection:

Laptop        192.168.1.20:52310
   |  (router rewrites source)
Router WAN    203.0.113.55:41002  -->  Internet
   |  (reply comes back to 203.0.113.55:41002)
Router looks up table  -->  delivers to 192.168.1.20:52310

The website only ever sees the router’s public address. Your device’s private address never leaves the local network. External hosts cannot reach it directly without extra configuration.

The main types of NAT

There are three main types of NAT: static, dynamic, and port address translation. Static NAT maps one private address to one public address. Dynamic NAT draws from a pool of public addresses. PAT, also called NAT overload, packs many devices onto a single public IP using ports.

Dynamic NAT has a catch. When the pool runs out of free public addresses, new connections are rejected until an existing mapping frees up. PAT avoids that ceiling by multiplexing on ports, which is why it dominates real-world deployments. On Linux, PAT with a dynamic public IP is also called masquerade, the term you will see in iptables rules.

SNAT vs DNAT: direction matters

Two more terms describe which direction NAT rewrites. They often appear in firewall logs and cloud configuration, so the distinction is worth knowing.

• SNAT (source NAT) rewrites the source address on outbound packets. This is what lets private devices reach the internet, and PAT is a form of it.
• DNAT (destination NAT) rewrites the destination address on inbound packets. This is how port forwarding sends outside traffic to a chosen internal host.

Most real networks run both at once: SNAT on the way out and DNAT on the way in. Reading a firewall log means tracking the pre-NAT and post-NAT addresses to see which translation applied.

Carrier-grade NAT (CGNAT) and shared address space

Carrier-grade NAT is a second layer of NAT run by your ISP. It places many customers behind a shared pool of public IPs using the 100.64.0.0/10 range from RFC 6598. Your router receives a 100.64 address instead of a real public IP, so your traffic is translated twice.

That produces a double-NAT chain. Your device is translated by your home router, and your router is translated again by the ISP:

Device      192.168.1.10   (RFC 1918, your LAN)
Router WAN  100.66.4.21    (RFC 6598, ISP shared space)
ISP CGNAT   203.0.113.90   (real public IP, shared by many)

CGNAT conserves IPv4, but it comes at a cost. Because you do not hold a unique public IP, CGNAT prevents direct inbound connections. Standard port forwarding cannot reach you, so self-hosting, some online games, and peer-to-peer apps struggle behind it. The mesh VPN Tailscale even borrows the same 100.64.0.0/10 block for its own addressing. If your ISP also assigns your router a 100.64 address, as Starlink does, routing can break. The device cannot tell the Tailscale network from the ISP WAN.

The 100.64.0.0/10 range sits outside the RFC 1918 blocks on purpose. It will not clash with the private addresses already inside your home. If the slash notation is new to you, our guide on CIDR notation breaks it down.

Port forwarding and NAT traversal

Port forwarding is a manual NAT rule that sends inbound traffic on a chosen port to a specific internal device. NAT traversal solves the harder case: two devices behind separate NATs that need a direct connection. Protocols like STUN, TURN, and ICE make that possible.

For the full walkthrough on setting one up, including router steps, NAT-type impact on gaming, and why it fails behind CGNAT, see our guide on port forwarding explained. Once you know the device’s internal IP and the ports involved, our Port Forwarding & NAT Rule Generator builds the exact router rule for you and flags the mistakes that usually break it.

Each tool plays a role in getting through NAT:

• STUN lets a device discover its own public IP and port. It can then share a reachable address with a peer.
• TURN relays traffic through a middle server when a direct connection fails, at the cost of extra latency.
• ICE is the framework that tries every candidate path and picks the best one that works.

A related quirk is hairpinning, where two devices on the same network reach each other through the router’s public IP. Not every router supports it. CGNAT makes traversal harder still, since many carriers disable the features that let hole punching succeed. How predictably a NAT behaves is set out in RFC 4787, and well-behaved NATs make traversal far easier.

Does IPv6 eliminate NAT?

IPv6 removes the need for NAT but not the habit of using it. With about 340 undecillion addresses, every device can hold its own public address, so translation becomes unnecessary. Firewalls remain, though, and adoption is still incomplete, so NAT is not going away soon.

The common myth is that NAT provides security, so IPv6 must be less safe. The protection NAT seems to offer is really just the firewall behavior of dropping unsolicited inbound traffic. A stateful IPv6 firewall does the same job on purpose, without translating a single address.

There is an IPv6 form of address translation called NPTv6, defined in RFC 6296. It is generally discouraged, though some enterprises still use it for provider independence. The whole point of IPv6 is enough addresses that no one has to hide behind translation at all.

How to tell if you are behind NAT

To tell if you are behind NAT, compare three addresses. Look at your device’s private IP, your router’s WAN IP, and the public IP the internet sees. If they differ, NAT is in play. A WAN IP in the 100.64.0.0/10 range means your ISP runs carrier-grade NAT.

Your device’s private address is easy to spot, since it starts with 192.168 or 10. If it instead starts with 169.254, that is a different situation entirely. Our guide on the 169.254 IP address explains it. To see the public address the world assigns you, use our My IP Address tool. Our guide on how to find your public IP address walks through it too.

If the public IP does not match your router’s WAN IP, a carrier NAT sits between you and the internet. You can confirm the location of that public exit with an IP geolocation lookup. It often points to your ISP rather than your town.

Frequently asked questions

Related tools