What Is NAT? Network Address Translation Explained

Last Updated: October 2026

What Does NAT Do?

Network Address Translation (NAT) is a process performed by your router that modifies IP address information in packet headers as traffic passes between your local network and the internet. At its core, NAT solves a simple problem: your home network might have 10, 20, or 50 devices, but your ISP only gives you one public IP address. NAT allows all those devices to share that single public address by keeping track of which internal device initiated each connection.

When a device on your network (say, your laptop at 192.168.1.100) sends a request to a web server, the router intercepts the outgoing packet and replaces the laptop's private source IP with the router's public IP. It also records the mapping in a NAT translation table so it knows to deliver the server's response back to the correct device. From the web server's perspective, the request came from the router's public IP — it has no knowledge of the private network behind it.

NAT was introduced in the 1990s as IPv4 address space began to run out. Without NAT, every device would need its own globally unique public IP address, and the 4.3 billion addresses provided by IPv4 would have been exhausted decades earlier. Today, NAT is running on virtually every home router, office gateway, and many carrier networks worldwide.

Why NAT Exists

The primary driver behind NAT is IPv4 address conservation. With roughly 4.3 billion IPv4 addresses and billions of connected devices, there simply are not enough public addresses for every device. NAT allows an entire household or organization to operate behind a single public IP, dramatically reducing the number of public addresses consumed.

Beyond address conservation, NAT provides a secondary benefit: a degree of implicit security. Because NAT only has translation entries for outbound connections initiated from inside the network, unsolicited inbound packets from the internet are dropped — there is no matching entry in the NAT table to tell the router where to send them. This prevents random internet hosts from directly reaching devices on your local network. However, NAT was never designed as a security mechanism and should not be relied upon as one. A proper stateful firewall provides actual security by inspecting and filtering traffic based on rules.

NAT also provides network topology hiding. External servers and attackers cannot see the private IP addresses, subnet layout, or number of devices behind your router. They only see a single public IP address, regardless of how many devices are connected internally.

How NAT Works: The Translation Table

The heart of NAT is the translation table (also called the NAT table or connection tracking table). This table maps each active connection between an internal device and an external server. Here is a step-by-step walkthrough:

1. Outbound packet: Your phone (192.168.1.50:54321) sends a DNS query to Google's DNS server at 8.8.8.8:53.
2. Router intercepts: The router receives the packet on its LAN interface. It creates a new entry in the NAT table:
   Internal: 192.168.1.50:54321 → External: 203.0.113.10:40001 → Destination: 8.8.8.8:53
3. Source rewrite: The router replaces the source address and port in the packet header with the public IP and the assigned external port (203.0.113.10:40001), then forwards the packet to the internet.
4. Server responds: Google's DNS server sends its response to 203.0.113.10:40001.
5. Reverse translation: The router receives the response, looks up port 40001 in its NAT table, finds that it maps to 192.168.1.50:54321, rewrites the destination address, and delivers the packet to your phone.
6. Table cleanup: After the connection is idle for a timeout period (typically 30–300 seconds for UDP, several minutes to hours for TCP), the entry is removed from the NAT table to free up resources.

A typical home router can maintain thousands to tens of thousands of simultaneous NAT entries. Enterprise-grade routers and firewalls can track millions. The NAT table is stored in RAM, so a router reboot clears all entries and temporarily disrupts active connections.

Types of NAT

Not all NAT implementations work the same way. The three primary types differ in how they map internal addresses to external addresses:

Static NAT (One-to-One NAT)

Static NAT creates a permanent, fixed mapping between one private IP address and one public IP address. Every packet from that internal device always uses the same public IP, and any inbound traffic to that public IP is always forwarded to the same internal device.

Static NAT is used when a server inside the private network needs to be consistently reachable from the internet — for example, a web server, mail server, or VPN endpoint. It requires a dedicated public IP for each internal server, so it does not conserve addresses. Static NAT is most commonly found in enterprise and data center environments where organizations have blocks of public IPs from their ISP.

Dynamic NAT

Dynamic NAT maps private IP addresses to a pool of public IP addresses on a first-come, first-served basis. When a device initiates a connection, the router assigns it an available public IP from the pool. When the connection ends, that public IP is returned to the pool for reuse. If all public IPs in the pool are in use, new connections are rejected until one becomes available.

Dynamic NAT is less common in modern networks because it still requires multiple public IPs (one per simultaneous internal device that needs internet access). It was more popular in early corporate networks before PAT became the standard approach.

PAT (Port Address Translation) / NAT Overload

PAT, also called NAT overload or NAPT (Network Address Port Translation), is the type of NAT used by virtually every home router and most business networks. It maps many private IP addresses to a single public IP address by using unique source port numbers to distinguish between connections.

When Device A (192.168.1.10:50001) and Device B (192.168.1.20:50001) both make requests, the router assigns different external ports to each: 203.0.113.10:40001 for Device A and 203.0.113.10:40002 for Device B. The destination server sees both requests coming from the same public IP but different ports, and the router uses the port number to route each response to the correct internal device.

Since TCP and UDP port numbers range from 0 to 65535, a single public IP can theoretically support up to 65,535 simultaneous NAT mappings (though practical limits are lower due to reserved port ranges and router memory). This is why PAT is so effective at conserving addresses — an entire neighborhood can share a handful of public IPs.

SNAT vs. DNAT

Network professionals often use the terms SNAT and DNAT to describe the direction of NAT translation:

• SNAT (Source NAT): The source IP address is modified. This is what your router does to outgoing traffic — it replaces your private source IP with the public IP. SNAT is the standard NAT behavior that allows internal devices to access the internet.
• DNAT (Destination NAT): The destination IP address is modified. This is what happens with port forwarding — incoming traffic destined for the router's public IP on a specific port is redirected to an internal device. DNAT enables external access to servers behind NAT.

In Linux's iptables/nftables firewall, SNAT and DNAT are explicitly configured as separate rules in the nat table. On consumer routers, SNAT happens automatically for all outbound traffic, while DNAT is configured through the port forwarding or "virtual server" settings in the admin panel.

NAT and Port Forwarding

By default, NAT blocks all unsolicited inbound connections — if the router does not have a matching entry in its NAT table, it drops the packet. This is a problem when you want external users or services to reach something inside your network, such as a game server, security camera, web server, or remote desktop.

Port forwarding solves this by creating a permanent DNAT rule that tells the router: "Any incoming traffic on this specific port should always be forwarded to this specific internal device." For example:

• External port 25565 → Internal 192.168.1.50:25565 (Minecraft server)
• External port 443 → Internal 192.168.1.100:443 (HTTPS web server)
• External port 3389 → Internal 192.168.1.200:3389 (Remote Desktop)

Port forwarding requires that the internal device has a static IP address (or a DHCP reservation) so the forwarding rule always points to the correct device. If the device's IP changes due to DHCP, the port forwarding rule will send traffic to the wrong place or to nothing at all.

UPnP (Universal Plug and Play) and NAT-PMP are protocols that allow devices to automatically create temporary port forwarding rules without manual configuration. Game consoles, video calling apps, and torrent clients commonly use UPnP to open the ports they need. While convenient, UPnP is a security risk because any device on the network can open ports without your approval — malware can exploit this to expose vulnerable services. Many security-conscious administrators disable UPnP and configure port forwarding manually.

For detailed troubleshooting when port forwarding is not working, see our How to Fix Port Forwarding Not Working guide.

NAT Traversal: STUN, TURN, and ICE

NAT creates a fundamental problem for peer-to-peer (P2P) communication. If two devices are both behind NAT, neither can initiate a connection to the other because both routers block unsolicited inbound packets. This affects VoIP calls, video conferencing, online gaming, file sharing, and any application where two endpoints need to communicate directly.

Several NAT traversal techniques have been developed to solve this problem:

STUN (Session Traversal Utilities for NAT)

STUN allows a device behind NAT to discover its public IP address and the type of NAT it is behind. The device sends a request to a STUN server on the public internet, and the server responds with the public IP and port the request came from. The device can then share this "reflexive" address with a peer, who can send traffic to it — provided the NAT type allows it.

STUN works well with full cone NAT (where the router forwards any incoming packet on the mapped external port) and restricted cone NAT (where the router forwards packets only from previously contacted IPs). It fails with symmetric NAT, which assigns a different external port for every destination — the port discovered via STUN will not work for a different peer.

TURN (Traversal Using Relays around NAT)

When STUN fails (typically because one or both peers are behind symmetric NAT), TURN provides a fallback by relaying all traffic through an intermediary server. Both peers connect to the TURN server, and data flows through it in both directions. This guarantees connectivity but adds latency and bandwidth costs because all traffic must travel through the relay instead of directly between peers.

ICE (Interactive Connectivity Establishment)

ICE is a framework (defined in RFC 8445) that combines STUN and TURN to find the best possible connection path between two peers. It works by gathering multiple candidate addresses (local IP, STUN-derived public IP, TURN relay address), exchanging them with the peer, and then testing each candidate pair to find the fastest working connection. ICE prioritizes direct connections (via STUN) and only falls back to TURN relaying when necessary.

WebRTC, used by Google Meet, Discord, and countless video calling and screen sharing applications, relies on ICE for NAT traversal. This is why video calls usually work even when both participants are behind NAT — ICE negotiates a path through or around the NAT automatically.

NAT Types for Gaming: Open, Moderate, Strict

Gaming consoles (PlayStation, Xbox, Nintendo Switch) and PC gaming platforms classify your NAT into three types that directly affect your multiplayer experience:

Open NAT (Type 1)

Your console has a public IP or is behind a full cone NAT with all necessary ports forwarded. You can connect to all other players regardless of their NAT type, host game sessions, and enjoy the best matchmaking experience. Achieving Open NAT typically requires port forwarding, placing the console in the DMZ, or using UPnP.

Moderate NAT (Type 2)

The most common NAT type for home connections with standard PAT. You can connect to players with Open and Moderate NAT, but not to players with Strict NAT. You may occasionally experience slower matchmaking or difficulty joining certain lobbies, but most multiplayer features work normally. This is what most gamers have by default.

Strict NAT (Type 3)

The most restrictive type, typically caused by symmetric NAT, double NAT, or aggressive firewall settings. You can only connect to players with Open NAT. Matchmaking is severely limited, voice chat may not work, and you cannot host game sessions. Strict NAT is a significant gameplay disadvantage in any multiplayer title.

How to improve your NAT type:

• Enable UPnP on your router — this allows the console to automatically open the ports it needs.
• Forward the required ports for your specific console and game. PlayStation uses ports 3478–3480 (TCP/UDP); Xbox uses port 3074 (TCP/UDP) and 88 (UDP).
• Place the console in the DMZ — this exposes all ports on the console to the internet. Effective but less secure than specific port forwarding.
• Fix double NAT if you have two routers — see the section below.
• Contact your ISP if you are behind CGNAT — you may be able to request a dedicated public IP.

Double NAT: Problems and Fixes

Double NAT occurs when your network traffic passes through two NAT devices in sequence. The most common scenario is when your ISP provides a modem/router combo (gateway) that performs NAT, and you connect your own separate router behind it, which also performs NAT. The path looks like:

Device (192.168.1.x) → Your Router (NAT #1) → ISP Gateway (NAT #2) → Internet

Double NAT causes several problems:

• Port forwarding fails: You can forward a port on your router, but the ISP gateway also needs the same port forwarded to your router's WAN IP. Most people forget this second step, or the ISP gateway does not support port forwarding at all.
• UPnP only works on one layer: Your console or application can automatically open ports on the nearest router, but has no way to open them on the second NAT device.
• VPN connections may fail: Some VPN protocols (especially IPsec) struggle with double NAT due to the way they handle packet encapsulation.
• Gaming NAT is degraded: Double NAT almost always results in Moderate or Strict NAT, causing matchmaking problems.
• Performance overhead: Every packet is translated twice, adding a small amount of latency and CPU load, though this is usually negligible on modern hardware.

How to Fix Double NAT

1. Bridge mode (recommended): Log into the ISP modem/router's admin panel and set it to bridge mode (also called "modem-only mode" or "passthrough mode"). This disables the ISP device's routing and NAT functions, turning it into a simple modem that passes the public IP directly to your router's WAN interface. Your router then becomes the sole NAT device.
2. DMZ on the ISP gateway: If bridge mode is not available, place your router's WAN IP address in the ISP gateway's DMZ. This forwards all incoming traffic to your router, effectively bypassing the ISP gateway's NAT for inbound connections.
3. Remove one router: If you do not need the features of your separate router, connect your devices directly to the ISP gateway and use it as your only router.
4. IP passthrough: Some ISP gateways (common with AT&T) offer an "IP passthrough" feature that assigns the public IP to a specific device (your router) while the gateway continues to provide other functions like Wi-Fi for other devices.

CGNAT (Carrier-Grade NAT)

Carrier-Grade NAT (CGNAT), also known as Large-Scale NAT (LSN), is NAT performed at the ISP level rather than at your home router. With CGNAT, your ISP assigns your router a private IP from the 100.64.0.0/10 range (defined by RFC 6598) instead of a real public IP. The ISP's infrastructure then translates that address to a shared public IP, which may be used by dozens or hundreds of subscribers simultaneously.

CGNAT is becoming increasingly common as ISPs exhaust their IPv4 address pools, especially in regions with rapidly growing internet adoption. It is particularly prevalent in mobile networks, developing markets, and newer ISP deployments that did not receive large IPv4 allocations.

Problems caused by CGNAT:

• Port forwarding is impossible: You do not control the ISP's NAT, so you cannot create forwarding rules for inbound connections.
• Hosting anything is impractical: Game servers, web servers, security camera remote access, and other services that require inbound connections will not work.
• Peer-to-peer is degraded: Torrent performance, VoIP quality, and P2P gaming may suffer because NAT traversal becomes much harder with an additional NAT layer.
• IP reputation issues: Because you share a public IP with other subscribers, if one of them engages in spam or abuse, the IP may be blacklisted, affecting your email delivery and access to certain services.
• Geo-location inaccuracy: The shared public IP may geolocate to the ISP's data center rather than your actual location.

How to detect CGNAT: Compare the WAN IP shown on your router's status page with the public IP shown by our What Is My IP tool. If they are different, you are behind CGNAT. The WAN IP will typically be in the 100.64.x.x range, though some ISPs use other private ranges.

How to work around CGNAT: Contact your ISP and request a dedicated public IP (some ISPs offer this for free, others charge a small monthly fee). Alternatively, use a VPN with port forwarding capabilities, or use IPv6 if your ISP supports it (IPv6 does not require NAT, so CGNAT does not apply).

NAT and IPv6

One of the primary goals of IPv6 is to eliminate the need for NAT entirely. With 2¹²⁸ addresses available, every device on Earth can have its own globally unique, publicly routable address. This restores the internet's original end-to-end connectivity model where any device can communicate directly with any other device without translation.

In IPv6 networks, security is provided by stateful firewalls rather than NAT. The firewall inspects connection state and enforces rules (e.g., block all unsolicited inbound traffic unless a rule explicitly permits it), providing the same protection that NAT offered as a side effect, but with proper security semantics and granular control.

Some organizations use NAT66 or NPTv6 (Network Prefix Translation for IPv6) for specific scenarios, such as multi-homing (connecting to multiple ISPs) without BGP, or hiding internal IPv6 topology. However, the IETF discourages IPv6 NAT because it breaks the end-to-end principle that IPv6 was designed to restore, and it reintroduces the same problems that NAT causes in IPv4 (broken peer-to-peer, complex troubleshooting, application compatibility issues).

NAT Hairpinning (NAT Loopback)

NAT hairpinning (also called NAT loopback or NAT reflection) is when a device inside the network tries to access a port-forwarded service using the router's public IP address, and the router correctly loops the traffic back to the internal server without sending it to the internet and back.

For example, suppose you have a web server at 192.168.1.100 with port 80 forwarded, and your public IP is 203.0.113.10. If your laptop (also on the same network at 192.168.1.50) tries to access http://203.0.113.10, a router that supports hairpinning will recognize that the destination is actually a local device and route the traffic internally. A router that does not support hairpinning will drop the packet or send it out to the internet, where it will either time out or be rejected.

Not all routers support NAT hairpinning. If yours does not, the workaround is to use the server's local IP address (192.168.1.100) when accessing it from inside the network, or configure split-horizon DNS so that your domain resolves to the internal IP for local devices and the public IP for external users.

NAT Security Implications

NAT is often misunderstood as a security feature. While it does provide some protection as a side effect, it is important to understand its limitations:

• Blocks unsolicited inbound traffic: NAT drops inbound packets that do not match an existing translation entry. This prevents random port scans and connection attempts from reaching your devices directly. However, this is a byproduct of how NAT works, not a designed security mechanism.
• Does not inspect packet content: NAT does not examine payloads, detect malware, prevent phishing, or block malicious websites. It only modifies addresses in the IP header.
• Bypassed by outbound connections: If a device on your network connects to a malicious server (e.g., by clicking a phishing link or running malware), NAT creates a table entry that allows the server to send data back. NAT cannot prevent this because the connection was initiated from inside the network.
• UPnP weakens NAT: If UPnP is enabled, any device on the network (including malware) can open ports through NAT without your knowledge or consent.
• Not a substitute for a firewall: A stateful firewall provides actual security by enforcing policies, inspecting connection state, blocking suspicious patterns, and logging events. NAT provides none of these capabilities.

The best security practice is to use NAT for address conservation (its intended purpose) and a properly configured firewall for security. Many modern home routers include a built-in stateful firewall in addition to NAT, but you should verify that it is enabled and configured appropriately.

Frequently Asked Questions

What is NAT (Network Address Translation)?

NAT is a technique performed by routers that translates private IP addresses on a local network to a public IP address (and back) as traffic crosses the network boundary. It allows multiple devices in a home or office to share a single public IP for internet access, solving the problem of IPv4 address shortage.

What are the different types of NAT?

The three main types are: Static NAT (one-to-one permanent mapping between a private and public IP), Dynamic NAT (maps private IPs to a shared pool of public IPs), and PAT / NAT Overload (maps many private IPs to one public IP using port numbers). PAT is by far the most common, used by virtually all home and small office routers.

How does port forwarding work with NAT?

Port forwarding creates a static DNAT rule that directs inbound traffic on a specific port to a specific internal device. For example, forwarding port 25565 to 192.168.1.50 tells the router to send all incoming Minecraft traffic to that device. Without port forwarding, NAT blocks inbound connections because there is no matching entry in the translation table.

What are NAT types in gaming (Open, Moderate, Strict)?

Open (Type 1): Can connect to all players and host sessions. Moderate (Type 2): Can connect to Open and Moderate players; the default for most home connections. Strict (Type 3): Can only connect to Open players, with severe matchmaking limitations. Port forwarding or UPnP can upgrade your NAT type from Strict/Moderate to Open.

What is double NAT and how do I fix it?

Double NAT occurs when traffic passes through two NAT devices, such as an ISP gateway and your own router. It breaks port forwarding, degrades gaming NAT type, and can interfere with VPNs. Fix it by setting the ISP device to bridge mode, placing your router in the ISP device's DMZ, or using IP passthrough if available.

What is CGNAT (Carrier-Grade NAT)?

CGNAT is NAT performed by your ISP rather than your home router. Your router gets a private address (usually from 100.64.0.0/10), and the ISP translates it to a shared public IP. This makes traditional port forwarding impossible. Detect it by comparing your router's WAN IP with our What Is My IP tool — if they differ, you're behind CGNAT. Request a dedicated public IP from your ISP to resolve it.

What is NAT traversal (STUN, TURN, ICE)?

NAT traversal techniques enable peer-to-peer connections between devices that are both behind NAT. STUN discovers your public IP and port mapping for direct connections. TURN relays traffic through an intermediary when direct connection fails. ICE is a framework that tries STUN first and falls back to TURN. WebRTC, VoIP, and video calling apps all use these protocols.

Does IPv6 eliminate the need for NAT?

Yes. IPv6 provides enough addresses for every device to have a globally unique, publicly routable address, removing NAT's primary purpose of address conservation. Security in IPv6 is handled by stateful firewalls rather than NAT. While NAT66/NPTv6 exists, it is discouraged by the IETF because it undermines the end-to-end connectivity that IPv6 was designed to restore.