Quick Summary
- NAT (Network Address Translation) lets multiple devices share one public IP address by rewriting packet headers
- SNAT rewrites the source address on outgoing traffic; DNAT rewrites the destination on incoming traffic (port forwarding)
- Your router maintains a connection tracking table to remember which internal device each conversation belongs to
The Front Desk Analogy
Imagine you live in an apartment building. The building has one street address: 203 Main Street. But inside, there are dozens of residents, each in their own unit. When a delivery driver shows up with a package for "Apartment 10," the front desk knows exactly which resident to call. When a resident sends a letter, the front desk puts the building's street address as the return address -- not the resident's room number.
NAT works exactly like that front desk. Your home network has many devices -- phones, laptops,
smart speakers -- each with their own private "room number" (like 192.168.1.10). But your internet
service provider only gave you one public "street address" (like 203.0.113.1). Your router acts as
the front desk, rewriting addresses on every packet so that the outside world sees only the single public IP,
while internally keeping track of which device each conversation belongs to.
NAT stands for Network Address Translation. It was invented in the 1990s as a practical solution to a looming crisis: the world was running out of IPv4 addresses. With only about 4.3 billion possible addresses and billions of devices coming online, something had to give. NAT allowed entire households and offices to hide behind a single public address, stretching the IPv4 supply far beyond what anyone expected.
How NAT Translates Addresses
Here is what happens when three devices on your home network access the internet through a single public IP:
Try It Yourself
Click "Send" on any device to see SNAT in action. Toggle DNAT mode to simulate port forwarding.
93.184.216.34
| Internal IP:Port | External IP:Port | Destination | Direction |
|---|
Notice the key detail: every device gets a unique port number on the public side. The router
uses these port numbers to tell conversations apart. When a reply comes back to 203.0.113.1:41234,
the router checks its table and knows to forward that packet to the laptop at 192.168.1.10.
NAT Step by Step
Why Private IPs Exist
There are only about 4.3 billion IPv4 addresses, but there are far more devices in the world. To solve
this, three ranges were reserved for private use: 10.0.0.0/8, 172.16.0.0/12,
and 192.168.0.0/16. These addresses are not routable on the public internet.
Any organization can use them internally without coordination. Your home router uses
192.168.1.x, and so does your neighbor's -- there is no conflict because NAT ensures only
public addresses appear on the internet. Private IPs are the "room numbers" that never leave the building.
SNAT: Translating Outbound Traffic
Source NAT (SNAT) is what happens when your device sends a request to the internet. Your
laptop sends a packet with source address 192.168.1.10:41234 destined for a web server. The
router intercepts this packet and replaces the private source address with its public address:
203.0.113.1:41234. It records the mapping in its connection tracking table. The web server
never sees your private address -- it only sees the router's public IP. This is the most common form of
NAT and is what people usually mean when they simply say "NAT."
DNAT: Port Forwarding for Inbound Traffic
Destination NAT (DNAT) works in reverse. Suppose you run a web server on your laptop at
192.168.1.10:80 and want the outside world to reach it. You configure a port forwarding rule
on your router: "any traffic arriving at 203.0.113.1:8080 should be forwarded to
192.168.1.10:80." The router rewrites the destination address on incoming packets, replacing
its own public IP with your laptop's private IP. This is how you host game servers, security cameras, or
any service behind a NAT router.
Connection Tracking: Remembering the Conversation
NAT would not work without connection tracking (also called "stateful NAT"). Every time a new connection is established, the router creates an entry in its tracking table that maps the internal address and port to the external address and port. When a reply arrives from the internet, the router looks up the destination port in its table to find the correct internal device. Entries are automatically removed after a timeout period (typically 30 seconds for UDP, several minutes for TCP). This is why NAT is considered "stateful" -- the router must remember every active conversation.
NAT in the Real World
NAT is everywhere -- from your living room to cloud data centers. Here are three examples you encounter regularly:
Home WiFi Router
Every home router performs NAT. Your ISP assigns you one public IP, and your router shares it among all your devices using SNAT. This is why you can have 20 devices streaming Netflix simultaneously -- each gets its own port number on the public side, and the router keeps track of them all. You never need to think about it; it just works.
Docker Port Mapping
When you run docker run -p 8080:80, Docker sets up a DNAT rule. Traffic arriving at your
host machine on port 8080 is forwarded to port 80 inside the container. The container has its own private
IP on a virtual network, and Docker's NAT layer translates between the host and container addresses.
This is the same NAT concept, applied to virtual networking.
AWS NAT Gateway
In cloud environments like AWS, servers in private subnets cannot reach the internet directly. An AWS NAT Gateway sits in a public subnet and performs SNAT for all outbound traffic from private instances. This lets your database servers download security updates without exposing them to inbound internet traffic. It is the same apartment front desk pattern, scaled to the cloud.
Common NAT Mistakes
NAT usually works transparently, but these issues trip people up regularly:
Double NAT
Double NAT happens when you have two routers in a row, each performing NAT. For example, your ISP gives you a router, and you plug your own WiFi router behind it. Now your traffic is translated twice: first by your router, then by the ISP's router. This breaks port forwarding, slows down gaming, and makes peer-to-peer connections unreliable. The fix is to put one of the routers in bridge or passthrough mode so only one device performs NAT.
Hairpin NAT
Hairpin NAT (also called NAT loopback) is when a device on your internal network tries to access your own
public IP address. For example, you have a server at 192.168.1.10 with port forwarding set
up on your public IP. When another internal device tries to connect to your public IP, the traffic goes
to the router, gets forwarded back inside, but the return path breaks because source and destination are
on the same network. Many consumer routers do not handle this correctly, causing mysterious connection failures.
Missing Return Path
If a server behind NAT sends a packet out to the internet but the return traffic takes a different path (perhaps through a second router that does not have the connection tracking entry), the NAT router will drop the reply because it does not recognize it. This is common in multi-homed networks or asymmetric routing setups. The rule is simple: return traffic must flow through the same NAT device that translated the outbound packet.
NAT and IPv6: The Long-Term Fix
NAT was designed as a temporary workaround for IPv4 address exhaustion, but it has persisted for decades. IPv6 provides 340 undecillion addresses -- enough for every grain of sand on Earth to have its own IP. With IPv6, NAT becomes unnecessary because every device can have a globally unique, publicly routable address. However, IPv6 adoption has been gradual, and NAT remains deeply embedded in how networks operate today. Understanding NAT is essential even in an IPv6 world, because most networks still run dual-stack (both IPv4 and IPv6) and will for years to come.
NAT Types in Gaming and VoIP
If you have ever seen your game console report a "NAT Type" (Open, Moderate, or Strict), that is describing how restrictive your NAT configuration is. Open NAT means your router allows inbound connections freely (usually via UPnP or manual port forwarding). Strict NAT means only outbound connections are allowed, and no unsolicited inbound traffic gets through. Strict NAT causes problems with peer-to-peer games, voice chat, and video calls because both sides of the connection are behind NAT and neither can initiate the connection. Technologies like STUN and TURN servers work around this by helping devices discover their public addresses and relay traffic when direct connections fail.
Frequently asked questions about NAT
What does NAT stand for?
NAT stands for Network Address Translation. It is a technique where a router rewrites the IP addresses in packet headers so that many devices on a private network can share a single public IP address.
How does NAT work?
When a device on your private network sends a packet to the internet, your router replaces the device's private source IP with its own public IP and records the mapping in a connection-tracking table. When the reply comes back, the router uses that table to forward it to the correct internal device.
What is the difference between SNAT and DNAT?
SNAT (Source NAT) rewrites the source address on outgoing packets — this is what your home router does so multiple devices can share one public IP. DNAT (Destination NAT) rewrites the destination address on incoming packets and is the mechanism behind port forwarding.
Is NAT a firewall?
No. NAT is not designed as a security control, but it does provide an incidental side effect: unsolicited inbound connections have nowhere to go because there is no NAT mapping for them. A real firewall enforces explicit allow/deny rules and tracks connection state for security purposes.
Does IPv6 eliminate the need for NAT?
Yes, in theory. IPv6 has enough addresses that every device can have its own public address, so address-sharing NAT is unnecessary. In practice, many networks still use NAT-style techniques with IPv6 for policy, privacy, or migration reasons.
Ready to try NAT yourself?
You just learned how NAT works. Now trace packets through a NAT gateway and see every address rewrite hop by hop, add a port forward, and press Go Live to run the same rules as real iptables NAT on Linux.
Launch the NAT lab →