PlayInfoBox

Home /Network /What Is NAT (Network Address Translation)? The Basics Explained

What Is NAT (Network Address Translation)? The Basics Explained

Why can every device in your house get online at once through a single router? Here is the principle behind NAT.

What NAT (Network Address Translation) is

NAT is the core router function that translates between the private IP addresses used inside a home or office network and the single public IP address that actually reaches the internet.

Why NAT exists: IPv4 address exhaustion

There are only about 4.3 billion possible IPv4 addresses worldwide, nowhere near enough to give every phone, laptop, and IoT device its own public address. NAT lets dozens of devices in a single household share the one public IP address an internet provider assigns, acting as the practical compromise that has kept IPv4 usable long past when it would otherwise have run out.

PAT (Port Address Translation): what your home router actually does

A laptop and a phone can be online at the same time without their traffic getting mixed up because the router maps each internal (private IP, port) pair to a different port number on the single public IP β€” the laptop's requests might go out on port 40001 and the phone's on port 40002, and incoming replies are routed back based on which port they arrive on. This port-based scheme, called PAT (Port Address Translation) or NAPT, is what home routers actually run.

The NAT table: the router's memory of every mapping

Every time a new connection starts, the router creates a temporary entry recording something like "internal 192.168.0.5:51000 maps to public-IP:40001 on the way out." That entry is automatically removed once the connection ends or goes quiet for a while, and if it disappears too soon for something like an online game or video call that needs a long-lived connection, the connection can drop unexpectedly.

Static NAT vs. dynamic NAT

Static NAT permanently pairs one private IP address with one public IP address, which suits a server that always needs to be reachable at the same external address. Dynamic NAT instead draws from a pool of available public addresses and assigns one temporarily as needed, which is useful in a business network sharing a limited number of public IPs among many users. What a typical home router does day to day, though, is much closer to the port-based PAT described above than either of these.

NAT's limitation: port forwarding and peer-to-peer connections get harder

Because NAT only sends replies back for connections that originated from inside the network, an outside connection trying to reach in first β€” like a home server or a game console's peer-to-peer matchmaking β€” is blocked by default with no extra configuration. Solving this requires port forwarding, which opens a specific port to a designated internal device, or UPnP, which opens ports automatically as needed. The Open/Moderate/Strict NAT type labels seen in online gaming ultimately trace back to this same limitation.

NAT's side-effect security benefit

NAT was not designed as a security feature, but it produces a firewall-like side effect: an outside attacker probing your public IP gets nowhere, because without a matching entry in the NAT table, the router has no way to know which internal device the traffic should go to, and simply drops it.

Why long-lived connections sometimes drop unexpectedly

The NAT table entry behind every connection has a limited lifetime, and once it expires from inactivity, the router forgets where to send a reply. Online games and video calls, which need a connection to stay open for long stretches with only occasional traffic, are especially prone to this β€” a call that goes silent for too long, or a game session with a lull in network activity, can find its NAT mapping expired and the connection unexpectedly cut. Applications aware of this problem typically send small "keepalive" packets at a fixed interval specifically to keep the NAT table entry alive.

NAT is not a firewall, even though it can feel like one

NAT's tendency to block unsolicited inbound connections is a side effect of how it works, not a designed security control β€” it has no concept of malicious versus benign traffic, no logging of blocked attempts, and no ability to inspect what is inside a packet. A real firewall applies deliberate rules to decide what traffic is allowed, which is why relying on NAT alone, without any actual firewall protection, leaves a network without the fine-grained control a genuine security tool provides.

Frequently Asked Questions

Is NAT the same thing as a firewall?

No. NAT's job is only to translate addresses; blocking unsolicited outside connections by default is a side effect of how that translation works, not a deliberate security feature. Filtering traffic with fine-grained rules requires a separate, actual firewall function.

If I use IPv6, do I still need NAT?

IPv6's address space is vast enough that, in theory, every device could have its own public address, making NAT unnecessary. In practice, though, most networks run IPv4 and IPv6 side by side for the foreseeable future, so NAT is likely to remain in everyday use for a while yet.