Network address translation (NAT)
Also known as: NAT, network address translation, port address translation
Network address translation (NAT) is a technique routers use to let many devices on a private network share a single public internet address.
The router swaps private addresses for its public one on outgoing traffic and keeps track of connections so replies return to the right device. While NAT stretched the limited supply of IPv4 addresses for decades, it also complicates gaming, video calls, and hosting services from home.
Network address translation (NAT), explained at three levels
At home
NAT works like a company receptionist with one main phone number. Staff place calls from their own desk extensions, but the person on the other end sees only the company's main number. When they call back, the receptionist remembers who called and forwards it to the right desk. Your router does the same, letting all your devices share one public internet address.
At work
Network address translation is a router function that rewrites addresses in network traffic, so many devices with private addresses can share one or a few public IPv4 addresses. Businesses rely on it because public IPv4 addresses are scarce and costly. It also shapes how outside users reach internal systems, since any server meant to be reachable from the internet needs its own NAT rule.
At home
When your laptop at 192.168.1.20 opens a website, the router replaces the 'from' address with your public address and also swaps the port number for a unique one. It writes that pairing into a translation table. When the reply returns to that public address and port, the router looks up the table and forwards it to your laptop. Entries expire after a period of silence, which is why some idle connections drop.
At work
There are several common forms. Port address translation, or PAT, maps many private addresses to one public address using unique port numbers, and handles most office outbound traffic. Static NAT maps one private address to one public address, often for servers. Destination NAT, or port forwarding, sends inbound traffic on a chosen port to an internal host. Carrier-grade NAT, which uses the shared 100.64.0.0/10 range, adds another translation layer at the provider, sharing a public address among many customers.
At home
NAT breaks the internet's original idea that any device can reach any other. Two players behind NAT cannot connect directly, so games and video calls use tricks: STUN discovers your public address, hole punching opens a path from both sides at once, and TURN relays traffic when nothing else works. A 'strict NAT' warning means those tricks are failing. While UPnP fixes it automatically, in my opinion it should only be enabled for trusted devices, since any app can open ports with it.
At work
NAT is not a security control, even though it drops unsolicited inbound traffic as a side effect; the stateful firewall does the real filtering. NAT also complicates operations. IPsec VPNs need NAT traversal, SIP voice systems need helpers or session border controllers, and overlapping private ranges clash when companies merge networks. Under carrier-grade NAT, identifying a user requires the public address, port, and exact timestamp, so retaining translation logs matters for incident response and lawful requests.
Real-world examples
At home
Jerome's game console warned about 'strict NAT' and he couldn't join friends' online parties. Enabling UPnP on his router fixed it.
At work
Nadia is a network admin at a Quebec City engineering firm. She set up a static NAT rule so the office's file transfer server could be reached from outside, with firewall rules limiting who can connect.
Common confusions
- NAT is a firewall. — NAT blocks unsolicited inbound traffic as a side effect, but it isn't designed as a security tool. A real firewall is still needed.
- Every device in my home has its own public internet address. — With IPv4 and NAT, they share one public address. Each device has a private address inside the home.
For analysts
When troubleshooting 'can't connect from outside' issues, I'd check NAT and port forwarding first. And I'd document every forwarding rule, since forgotten ones become security holes.
History & origin
As IPv4 addresses grew scarce in the early 1990s, Kjeld Egevang and Paul Francis described NAT in RFC 1631, published in 1994, as a short-term fix. It became universal in home and office routers through the late 1990s and 2000s. Internet providers later added carrier-grade NAT, sharing one public address among many customers, especially on mobile networks. Techniques such as STUN, TURN, and UPnP emerged to help applications work through NAT. IPv6 was designed so NAT would no longer be needed, but NAT remains deeply embedded. In my view, NAT is the temporary fix that became permanent, and it shaped how home internet works more than most people realize.