NAT & PAT Explained
Demystify Network Address Translation and Port Address Translation. Learn how NAT translates private IPs, the translation table process, and how to fix Double NAT.
What is NAT (Network Address Translation)?
NAT is a network protocol that enables a router to translate the private IP addresses of devices on a local network (LAN) into a single public IP address (or a small pool of public IPs) before forwarding packets to the public Internet. Developed in the mid-1990s, NAT was created as a temporary solution to slow down the exhaustion of the 32-bit IPv4 address pool. Today, it is used in almost every home and business network in the world.
Without NAT, every device in your home (smartphones, laptops, smart TVs) would require its own unique, expensive public IP address. Instead, NAT allows all your devices to share one public IP address assigned by your Internet Service Provider (ISP), while utilizing free private IP ranges (like `192.168.1.x`) internally.
Security Benefit: NAT adds a layer of security because it hides the internal network topology from the public Internet. External hosts cannot initiate direct connections to your local devices unless you explicitly configure port forwarding rules.
Symmetric Types of Translation: Static NAT, Dynamic NAT, and PAT
Depending on the requirements, network administrators configure different variations of NAT:
| Translation Type | Mapping Ratio | How It Works | Primary Use Case |
|---|---|---|---|
| Static NAT | 1-to-1 (Fixed) | Maps a single private IP address to a single, dedicated public IP address. The mapping never changes. | Hosting internal servers (web, mail) that must be accessible from the public Internet. |
| Dynamic NAT | 1-to-1 (Dynamic) | Maps an internal private IP to a public IP chosen from a pre-defined pool of available public IP addresses. First-come, first-served. | Enterprise networks with a pool of public IPs, where users need outgoing access but don't need fixed public IPs. |
| PAT (Port Address Translation / NAT Overload) | Many-to-1 | Maps thousands of internal private IP addresses to a **single** public IP address by assigning unique source port numbers to each connection. | Standard home routers and office networks. Allows multiple devices to share one public IP simultaneously. |
The NAT Translation Table Lookup Process
To keep track of which local device sent a request and route returning traffic to the correct computer, the router maintains a dynamic **NAT Translation Table**. The table translates four distinct address fields:
- Inside Local: The private IP address and port assigned to a device on the internal network (e.g., your computer at
192.168.1.50:50123). - Inside Global: The public IP address and port assigned by the router to represent the internal device to the public Internet (e.g., your public IP at
203.0.113.10:50123). - Outside Global: The public IP address and port of the final destination server on the Internet (e.g., Google Web Server at
8.8.8.8:443). - Outside Local: The IP address of the external host as seen by the internal network (usually identical to the Outside Global address).
Step-by-Step PAT Translation Example
Let's trace how a packet moves from your computer to Google and back using PAT:
- Outgoing Packet leaves your PC:
Source:192.168.1.50:51120(Inside Local)
Destination:8.8.8.8:443(Outside Global) - Router translates the packet: The router receives the packet on its LAN interface, strips the private source IP, replaces it with its public IP, and assigns a unique source port. It records this in the NAT table:
Source:203.0.113.10:10001(Inside Global)
Destination:8.8.8.8:443(Outside Global) - Google responds: Google receives the packet, processes the request, and sends the response back to the router's public IP:
Source:8.8.8.8:443(Outside Global)
Destination:203.0.113.10:10001(Inside Global) - Router routes the packet back: The router looks up port `10001` in its translation table, finds that it maps to your computer at `192.168.1.50:51120`, translates the destination IP/port back to the Inside Local address, and forwards it to your PC.
Double NAT: What It Is and How to Resolve It
Double NAT occurs when you have two routers connected in series, both performing network address translation. This commonly happens when you plug a personal Wi-Fi router (e.g., a mesh Wi-Fi system) into the modem/router combo box provided by your Internet Service Provider.
While basic web browsing and email will continue to work under Double NAT, it causes significant issues for several applications:
- Port Forwarding breaks: External connections cannot reach internal servers because the incoming port request is dropped at the first router.
- Online Gaming issues: Games will report a "Strict NAT Type," preventing you from hosting multiplayer matches, matchmaking, or using voice chat.
- VoIP and VPN drops: Real-time protocols get confused by the double translation layers, leading to dropped calls and connection failures.
How to Resolve Double NAT
To fix Double NAT, you must disable routing and translation on one of the two devices:
- Bridge Mode (Recommended): Log into your ISP modem/router combo and configure it to "Bridge Mode" (or "IP Passthrough"). This disables its routing and NAT functions, turning it into a simple modem, allowing your personal Wi-Fi router to receive the public IP address directly.
- Access Point (AP) Mode: Alternatively, log into your personal Wi-Fi router and switch its operation mode from "Router" to "Access Point." This disables its DHCP and NAT functions, allowing your ISP router to handle all addressing and routing.
Frequently Asked Questions (FAQ)
What is the difference between NAT and PAT?
NAT is the general technology of translating IP addresses. Static/Dynamic NAT maps private IP addresses to public IP addresses in a 1-to-1 ratio, requiring multiple public IPs to support multiple devices. **PAT (Port Address Translation)** is a specific type of NAT (many-to-1) that allows thousands of devices to share a *single* public IP address simultaneously by translating the source port numbers along with the IP address.
What is Port Forwarding?
Port Forwarding (or static PAT) is a configuration rule on a router that instructs it to direct all incoming traffic on a specific public port directly to a specific private IP address and port inside your LAN. This is required if you want to host a multiplayer game server (like Minecraft), web server, or IP security camera so external users can connect to it.
Does IPv6 use NAT?
No. IPv6 has a massive address space, allowing every device to have a unique, public IP address. NAT was created to conserve the limited IPv4 address pool. Because IPv6 eliminates address exhaustion, NAT is not needed, restoring the original end-to-end direct routing design of the Internet.
What is CGNAT (Carrier-Grade NAT)?
CGNAT is a large-scale NAT deployed by ISPs. Instead of giving your home router a unique public IP, the ISP assigns your router a private IP from a shared range (typically `100.64.0.0/10`) and performs NAT at their data center. CGNAT allows ISPs to share a single public IP among hundreds of different homes, but it makes port forwarding from your home router impossible without a VPN or static IP subscription.
What's Next?
Advance your network routing studies:
- Explore how routers forward packets between subnets in Routing & Switching.
- Learn how IP addressing works at Layer 3 in IP Addressing & Subnetting.
- Learn how transport protocols carry port data in Network Protocols.
- Study the physical boundary devices in Topologies & Hardware.