What Is NAT (Network Address Translation)?

NAT (Network Address Translation) is the process by which a router rewrites the IP addresses, and usually the port numbers, of packets passing through it. Its most common job is letting every device on your home network share one public IPv4 address: the router swaps each device's private address for its own public one on the way out, and remembers the mapping so replies find their way back.

NAT is so universal that most people use it every day without knowing it exists. It is also behind several familiar frustrations, from port forwarding to "strict NAT" warnings on game consoles. This guide explains how it works and why IPv6 was designed to do without it.

Why NAT exists

An IPv4 address is 32 bits long, which allows roughly 4.3 billion addresses. That is far fewer than the number of phones, laptops, TVs and sensors connected today. To stretch the supply, RFC 1918 set aside three blocks of private addresses that anyone can use internally but that are never routed on the public internet:

Millions of homes can all use 192.168.1.0/24 at the same time because those addresses never leave the house. NAT is the bridge between that private world and the public internet. Our guide to public vs private IP addresses covers the address side in more depth.

How NAT works, step by step

Suppose your laptop at 192.168.1.20 opens a web page on a server at 198.51.100.80, and your router's public address is 203.0.113.7.

1. The laptop sends a packet from 192.168.1.20:51000 to 198.51.100.80:443. The source port 51000 is picked at random by the laptop.
2. The router replaces the source with its own public address and a port of its choosing, say 203.0.113.7:40001, and records the mapping in its NAT table.
3. The server replies to 203.0.113.7:40001. It has no idea the laptop exists.
4. The router looks up port 40001 in its table, rewrites the destination back to 192.168.1.20:51000, and delivers the packet to the laptop.

A simplified NAT table looks like this:

Entries expire after a period of inactivity. TCP mappings are usually removed when the connection closes; UDP mappings, which have no "close", time out after a short idle period. This is why long-lived idle connections sometimes silently break behind NAT and why apps send keepalive packets.

Types of NAT: SNAT, DNAT and PAT

Source NAT (SNAT)

Source NAT rewrites the source address of outgoing packets. The example above is source NAT. On Linux firewalls, the variant that automatically uses whatever address the outgoing interface currently has is called masquerading.

Destination NAT (DNAT)

Destination NAT rewrites the destination address of incoming packets. It is how port forwarding works: a rule such as "send TCP port 8080 arriving at 203.0.113.7 to 192.168.1.50:80" is a DNAT rule. Load balancers use the same idea to spread incoming traffic across several servers.

PAT, also called NAPT or NAT overload

Port Address Translation translates ports as well as addresses, which is what allows many inside devices to share a single outside address at the same time. Each connection is distinguished by its translated port. Almost every home router performs PAT, and when people say "NAT" in a home context, PAT is what they mean.

Static (one-to-one) NAT

Static NAT permanently maps one inside address to one outside address. It is used in business networks and cloud platforms, where a virtual machine with a private address is given a dedicated public "elastic" or "floating" IP.

Port forwarding and inbound connections

NAT handles outbound connections automatically, but an unsolicited inbound packet arriving at the router has no table entry, so the router does not know which device should receive it and drops it. To run a server at home you must create a port forwarding rule:

1. Give the server a fixed local address, ideally with a DHCP reservation in the router.
2. In the router's port forwarding page, forward the external port (for example TCP 25565 for a Minecraft server) to the server's local IP and port.
3. Allow the port in the server's own firewall.
4. Test from outside your network with our open port checker. Testing from inside often fails even when the rule is correct, because many routers do not support NAT loopback (hairpinning).

Applications can also request forwards automatically with UPnP IGD or NAT-PMP/PCP. This is convenient for games and voice apps but lets any software on your network open ports, so many people prefer to disable UPnP and add rules by hand. See our list of common network ports to identify what a port is used for.

NAT types and NAT traversal

Peer-to-peer applications such as video calls, online games and WebRTC need two devices, both behind NAT, to talk directly. Whether that works depends on how each NAT behaves. Older terminology (from RFC 3489) classifies NATs as full cone, restricted cone, port-restricted cone and symmetric. The key difference is whether the NAT reuses the same external port for all destinations (easy to traverse) or picks a new one for each destination (symmetric, hard to traverse). Game consoles summarize this as Open, Moderate or Strict NAT.

The standard toolkit for getting through NAT is:

• STUN, which lets a device discover its public address and port as seen from outside.
• Hole punching, where both peers send packets to each other at the same time, creating matching NAT entries on both sides.
• TURN, a relay server used as a fallback when direct connection is impossible.
• ICE, which tries all of the above and picks the best path that works.

Is NAT a firewall?

NAT is not a security feature, but it has a side effect that looks like one: because unsolicited inbound connections have no mapping, they are dropped. A real firewall makes that behavior explicit and adds rules, logging and protection against things NAT ignores. Home routers combine the two, applying a stateful firewall alongside NAT. Do not rely on NAT alone; UPnP, port forwards and malware making outbound connections all bypass it.

Why IPv6 does not need NAT

IPv6 addresses are 128 bits long. A typical home receives an entire /64 or larger prefix, which contains more addresses than the whole IPv4 internet many times over. Every device can have its own globally unique address, so there is no shortage for NAT to solve.

That restores the internet's original end-to-end model: devices can connect to each other directly, without port mapping tricks, and peer-to-peer applications become simpler. Security comes from the router's stateful IPv6 firewall, which by default blocks unsolicited inbound connections just as NAT did, while allowing you to open specific ports to specific devices. A related mechanism, NPTv6 (RFC 6296), can translate one IPv6 prefix to another, but it is rarely needed on home networks. Learn more in our comparison of IPv4 vs IPv6.

Frequently asked questions

Does NAT slow down my internet?

Not noticeably. Translating headers is a simple operation that home routers do in hardware or highly optimized software. Problems only appear when a router's NAT table fills up, which can happen with very large numbers of simultaneous connections on low-end hardware.

What is double NAT?

Double NAT means your traffic is translated twice, typically because you have your own router plugged into an ISP modem that is also routing. Browsing works fine, but port forwarding requires rules on both devices. Putting the ISP device in bridge mode removes one layer.

Can websites see my private IP address?

Not through normal connections, because NAT replaces it with your public address. WebRTC in browsers can expose local addresses in some configurations, though modern browsers now hide them using randomized mDNS hostnames.

How can I tell if I am behind NAT?

Compare the IP address shown in your device's network settings with your public IP. If your device has a private address such as 192.168.x.x or 10.x.x.x, NAT is in use.