What is NAT?
NAT is the technology that translates private IP addresses into public ones. It's the secret behind ten devices in your home sharing a single public IP to reach the internet.
01Why is NAT needed?
IPv4 offers only ~4.3 billion addresses; the number of connected devices is far beyond that. The workaround: everyone inside uses private IPs, and one public IP is shared at the exit.
Internal (private) NAT Internet (public)
192.168.1.10 ────┐
192.168.1.11 ────┼───→ [Router] ───→ 203.0.113.5
192.168.1.12 ────┘ (NAT)
02Private IP ranges
Reserved by RFC 1918, never routed on the internet:
| Class | Range | CIDR | Addresses |
|---|---|---|---|
| A | 10.0.0.0 – 10.255.255.255 | /8 | 16.7 million |
| B | 172.16.0.0 – 172.31.255.255 | /12 | 1 million |
| C | 192.168.0.0 – 192.168.255.255 | /16 | 65,536 |
03NAT types
1. Static NAT (1:1)
Inside: 192.168.1.10 ←→ Outside: 203.0.113.10
A fixed public IP for each internal IP. Used for servers; needs many public IPs.
2. Dynamic NAT
Inside IPs → [NAT pool] → outside IPs
A free IP is taken from the pool; when the pool runs dry, new connections wait.
3. PAT (Port Address Translation)
192.168.1.10:5000 → 203.0.113.5:40001
192.168.1.11:5000 → 203.0.113.5:40002
192.168.1.12:5000 → 203.0.113.5:40003
The most common type: one public IP, thousands of connections — told apart by port number. Also called "NAT overload"; this is what home routers do.
04How PAT works
Outgoing packet
PC1: 192.168.1.10:3000 → google.com:443
The router records in its NAT table:
| Inside IP:Port | Outside IP:Port |
|---------------------|-------------------|
| 192.168.1.10:3000 | 203.0.113.5:40001 |
The outgoing packet is now:
203.0.113.5:40001 → google.com:443
Incoming reply
google.com:443 → 203.0.113.5:40001
Router checks the table: 40001 → 192.168.1.10:3000
Forwards inside: google.com:443 → 192.168.1.10:3000
05NAT's limitations
- Peer-to-peer pain — two devices behind NATs can't find each other directly
- Some protocols struggle — FTP, SIP and others that carry IPs in the payload
- Port ceiling — ~65,000 concurrent connections per public IP
- End-to-end connectivity breaks — the IP changes mid-path
06Port forwarding
The way to reach a server behind NAT from outside:
Internet → Router (203.0.113.5:80) → Web server (192.168.1.100:80)
Router rule: forward everything arriving on external port 80 to 192.168.1.100:80. This is exactly what you configure when hosting a game server at home.
07Summary
- NAT = private IP ↔ public IP translation; the practical fix for IPv4 scarcity
- PAT shares one IP across thousands of connections via port numbers
- Your home router is doing PAT right now
- The cost: broken end-to-end connectivity — one of the problems IPv6 solves