Network Address Translation (NAT) is a process used by routers and firewalls to modify the source or destination IP addresses in the headers of IP packets while they are in transit across a traffic routing device.
To understand NAT, you must first understand the difference between Public and Private IP Addresses. Private IPs (like 192.168.x.x or 10.x.x.x) cannot be routed on the global internet. If a packet with a private Source IP reaches an internet backbone router, it is immediately dropped. NAT solves this problem.
Why NAT is Used
- IPv4 Conservation: There are billions of devices on earth, but only 4.3 billion available IPv4 addresses. NAT allows an entire office of 500 computers (using private IPs) to share a single public IP address to access the internet.
- Publishing Internal Services: If you host a web server on a private network, people on the internet cannot reach it. NAT translates public requests to the internal server's private address.
- Security By Obscurity (Debated): NAT hides internal network structures from the outside world. However, NAT does NOT replace a Stateful Firewall. It is a routing mechanism, not a security boundary.
Types of NAT
1. Source NAT (SNAT) / Many-to-One / PAT
Also known as Port Address Translation (PAT) or NAT Overload. This is the NAT used in every home and office for outbound internet access.
The Flow: A LAN host (192.0.2.10) wants to reach a web server at 198.51.100.20:443. It sends the packet to the firewall. The firewall intercepts the packet, strips away the private Source IP (192.0.2.10), and replaces it with the firewall's own Public IP (203.0.113.10). It also assigns a unique temporary Source Port (e.g., 54321).
The firewall records this in its Translation Table. When the web server replies to 203.0.113.10:54321, the firewall intercepts the packet, checks the table, translates the destination back to 192.0.2.10, and delivers it to the LAN host.
2. Destination NAT (DNAT) / Port Forwarding
Used to allow external traffic from the internet to reach an internal server. The firewall translates the Destination IP of the incoming packet. For a deep dive, see Port Forwarding and DNAT Explained.
3. One-to-One NAT (Static NAT)
Used when a company owns a block of public IPs and wants to permanently map one specific Public IP to one specific Internal Private IP. This is common for mail servers (SMTP) or dedicated web servers.
| NAT Type | What Changes? | Primary Use Case |
|---|---|---|
| SNAT (PAT) | Source IP (Private to Public) | Allowing internal users to browse the internet. |
| DNAT | Destination IP (Public to Private) | Publishing internal services to the outside world. |
| 1-to-1 NAT | Source and Destination based on direction | Dedicated servers requiring a permanent public IP. |
Common NAT Troubleshooting
1. Overlapping Networks over VPN
If you build a Site-to-Site VPN between two offices, and both offices use 192.168.1.0/24 internally, routing is impossible. You must use complex NAT rules (Policy NAT) to translate one side's traffic into a fake subnet so the routers can distinguish between the two sites.
2. Double NAT
If an ISP provides a router that performs NAT, and a user plugs their own Wi-Fi router (which also performs NAT) behind it, traffic is translated twice. This can break gaming consoles, VoIP phones, and port forwarding rules.
3. Firewall Policy Missing
NAT is just translation, not permission. If you configure SNAT to translate internal IPs to the internet, you still must configure a Firewall Policy allowing the internal subnet to access the external zone. Without both, traffic fails.
Quick Summary
- NAT translates IP addresses in packet headers as they pass through a router.
- SNAT (PAT) is used for outbound internet access, sharing one public IP among many private IPs.
- NAT is a requirement for IPv4 routing to the internet, but does not provide security on its own.