NAT

NAT (Network Address Translation) allows multiple devices on a local network to share one public IP address. A router translates private addresses (such as 192.168.x.x) into a public address for internet traffic.

NAT comes in several variants: static NAT (one private to one public address), dynamic NAT (a pool of public addresses handed out as needed) and PAT (Port Address Translation, also called NAT overload), which lets many internal devices share one public IP by multiplexing traffic through different port numbers.

NAT became widely used because it helps reduce IPv4 address exhaustion and adds a basic layer of separation between internal and external networks. It is typically implemented in the same device as the firewall. In IPv6 networks NAT is less necessary, since the address space is large enough for every device to have a public address.

In practice the variant deployed in almost every home and small-business router is PAT rather than classic 1:1 NAT: many internal hosts share a single public IP through a stateful translation table that maps each internal IP + source port pair to a unique external port. The mapping is created on outbound traffic, so by default only return traffic for established flows is reachable from the internet — inbound connections require explicit port forwarding. At the carrier level, Carrier-Grade NAT (CGN/CGNAT) applies the same idea a second time across many subscribers, which is why some end users see no globally unique public IP at all.

The private ranges typically translated are defined in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. For applications that need inbound traffic without manual port forwarding, NAT-traversal helpers exist — UPnP, NAT-PMP/PCP and STUN/TURN — each trying to open or discover a usable external port through the translation layer. The translation table has a finite size and a per-flow idle timeout; large numbers of parallel connections (BitTorrent swarms, IoT fleets) can therefore exhaust ports or fill the table. The CGN layer at an ISP solves IPv4 scarcity for the operator, but at the same time makes peer-to-peer services, geolocation and abuse handling harder because many users share the same visible address. For pure IPv6-only access networks that still need to reach IPv4 services, NAT64 is used as a dedicated transition mechanism.