• Glossary
  • What is NAT (network address translation)?

Security glossary

What is NAT (network address translation)?

NAT (network address translation) is an addressing method that remaps one IP address space into another by changing address information in packet headers as traffic passes through a router or firewall. It lets many hosts with private addresses share a small number of public addresses, and it conserves IPv4 space.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Network Address Translation (NAT) is an addressing method that remaps IP address spaces by rewriting packet headers as traffic passes through routers or firewalls, enabling multiple private hosts to share public IPv4 addresses and conserving limited IPv4 space. NAT operates at Layer 3 (and Layer 4 for port translation) by maintaining translation tables that map internal addresses and ports to external ones, with Port Address Translation (PAT) being the most common form, allowing thousands of hosts to share a single public address. While NAT solved IPv4 address exhaustion and provides incidental connection filtering, it introduces operational challenges including state management, source attribution loss, protocol incompatibilities, and complexity in merged networks, though IPv6's vastly larger address space eliminates the primary driver for NAT adoption.

  • Port Address Translation (PAT) allows thousands of internal hosts to share one public IPv4 address by allocating different source ports for each connection, making it the most widely deployed NAT variant.
  • NAT operationally hides traffic sources, requiring accurate translation logs with timestamps to trace security incidents to specific internal hosts, since internet-facing logs show only the translated address.
  • IPv6 eliminates the need for NAT through its 128-bit address space that provides globally unique addresses for every device, though specialized translation mechanisms like NAT64 still exist for IPv6-only clients accessing IPv4 services.

NAT at a glance

AttributeValue
Full nameNetwork address translation
CategoryAddressing method
Defined inRFC 3022 (traditional IP network address translator) and RFC 2663 (terminology)
OSI layerLayer 3, with port translation touching layer 4
Primary useLetting hosts with private IPv4 addresses reach external networks through shared public addresses
Related termsIPv4, IPv6, Private IP address, Firewall, IP address management, DHCP

How NAT works

A NAT device sits between two address realms, commonly a private internal network and the public internet. It keeps a translation table that maps internal connections to external addresses and ports.

  1. Outbound packet arrives: An internal host sends a packet to an external destination. The packet reaches the NAT device with the host's private source address and source port.
  2. Translation entry created: The device selects a public address and, in port address translation, a source port. It records the mapping between the internal address and port and the external address and port in its translation table.
  3. Header rewritten: The device replaces the source address and port in the packet header and recalculates the checksums. It then forwards the packet toward the destination.
  4. Reply translated back: The external server replies to the public address and port. The device looks up the entry, restores the original internal destination, and forwards the packet to the host.
  5. Entry expires: When the connection closes or sits idle past a timeout, the device removes the table entry and may reuse the port.

Port address translation, also called NAT overload, is the most common form and allows thousands of internal hosts to share one public address. Static NAT maps one internal address to one external address, which suits inbound access to servers. Unsolicited inbound traffic has no table entry, so it is dropped unless a static mapping or port forward exists. Some protocols embed addresses in their payloads and need an application-layer helper to work through NAT.

Why NAT matters in enterprise networks

NAT became widespread because IPv4 offers only about 4.3 billion addresses, far fewer than the number of connected devices. Sharing one public address among many hosts delayed address exhaustion and let organizations number internal networks with the private ranges reserved in RFC 1918. The cost is state: every active connection occupies a table entry, so busy devices can exhaust ports or memory and drop new sessions.

Operationally, NAT hides the real source of traffic. Logs at the internet edge show only the translated address, so tracing an incident to an internal host requires translation logs with accurate timestamps. Overlapping private ranges after a merger often force translation between networks, which complicates routing, DNS answers and troubleshooting. Peer-to-peer applications, VoIP and some VPN designs can fail or need workarounds when NAT sits in the path.

NAT is not a security control by itself, though the lack of inbound mappings blocks unsolicited connections as a side effect. A stateful firewall provides the actual policy. IPv6 has a 128-bit address space, so address scarcity no longer drives translation, and RFC 4864 describes how to get the benefits often credited to NAT without it. Translation still appears in IPv6 for cases such as NAT64, defined in RFC 6146, which connects IPv6-only clients to IPv4 services.

Common NAT issues

A single public address has a limited pool of source ports, so a busy client or proxy can use them all. New connections then fail or stall intermittently, often during peak load, while existing sessions keep working.

Protocols that carry IP addresses or ports inside the payload can fail when only the headers are rewritten. Some voice, video and file transfer sessions connect but carry no media or data unless the NAT device has an application-level helper or the endpoints use traversal techniques.

Internet-facing logs show only the translated address, so many users appear as one. Investigators cannot trace an event to a host unless translation logs with timestamps and ports are kept and correlated.

Internal clients that reach a server through its public address may fail when the NAT device cannot loop the traffic back inside. Symptoms are services that work from the internet but time out from the internal network, and a common workaround is split-horizon DNS.

Merging networks that both use the same private range, often after an acquisition, causes routing conflicts. Teams add double NAT or translation between the realms, which complicates troubleshooting and DNS records.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

NAT FAQ

Related terms

Article

RFC 1918 networks

Ranges of IP addresses set aside for private use on TCP/IP networks.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Article

IPv6 (Internet Protocol version 6)

The most recent version of Internet Protocol, which uses 128-bit address space; there are 340 undecillion IPv6 addresses.

Learn more
Article

Internet Protocol Address (IP Address)

A numerical label assigned to each device connected to a network that uses IP for communication.

Learn more
Article

DMZ (Demilitarized zone)

A subnetwork that contains and exposes an organization’s external-facing services to an untrusted, usually larger, network such as the internet.

Learn more
Article

CIDR (Classless Inter-Domain Routing)

A method for allocating IP addresses and IP routing introduced by the ITEF 1993 to replace classful networks.

Learn more
Article

DNS – Domain Name System

A hierarchical naming system that enables communication across devices in a network.

Learn more
Article

ACL (Access Control List)

Limits which entities are allowed to perform certain functions against a DNS server, such as sending queries or performing dynamic updates.

Learn more
Browse the full glossary