Overview
There are far more devices than public IPv4 addresses to go around. NAT (Network Address Translation) is the mechanism that lets many devices on a private network share public addresses. This lesson explains what NAT does and why it is everywhere.
Learning objectives
- Define NAT and the problem it solves.
- Explain how private and public addresses relate through NAT.
- Describe NAT's effect on connectivity and security.
Core concept
NAT translates IP addresses as packets cross the boundary between a private network and the public internet. Devices inside use private addresses (e.g. 192.168.x.x); when their traffic goes out, the NAT device (typically the router) rewrites the source address to its own public address, and reverses the translation on the replies. This lets many private hosts share one (or a few) public addresses — the primary reason IPv4 has lasted despite address exhaustion.
How it works
The NAT router maintains a translation table mapping internal addresses/ports to external ones. Outbound: it replaces the private source address with its public address, records the mapping, and forwards the packet. Inbound replies: it looks up the mapping and rewrites the destination back to the correct internal host. Because internal addresses are hidden behind the public one, external hosts cannot directly address an internal device unless the NAT is explicitly configured to allow it (e.g. port forwarding).
Practical example
Your home has one public IP from your ISP but many devices on 192.168.1.x. When your laptop (192.168.1.50) requests a website, the router rewrites the source to its public IP and remembers the mapping. The website replies to the public IP; the router translates it back to 192.168.1.50. To the website, all your household's traffic appears to come from one address.
Cybersecurity relevance
NAT has a side effect of hiding internal structure: external parties see only the public address, not individual internal hosts, and cannot initiate connections inward by default. This is a form of obscurity and a basic barrier — but it is not a firewall and should not be relied on as a security control. Testers account for NAT when mapping targets (internal addresses are not directly reachable), and defenders combine NAT with actual firewall rules.
Common mistakes
- Treating NAT as a security control — it hides addresses but is not a substitute for a firewall.
- Confusing NAT with routing — NAT rewrites addresses; routing chooses paths.
- Forgetting inbound connections need explicit configuration (port forwarding) to reach internal hosts.
Key takeaways
- NAT translates private addresses to public ones (and back), letting many devices share limited public IPv4 addresses.
- The NAT device keeps a translation table, rewriting source addresses outbound and restoring them on inbound replies.
- NAT incidentally hides internal hosts, but it is not a firewall and must not be relied on as security.
Check your understanding
- What problem does NAT primarily solve, and how does it let many hosts share one public address?
- Why is NAT not a substitute for a firewall, even though it hides internal addresses?