What Is NAT (Network Address Translation)?

Network Address Translation (NAT) is the quiet trick that lets one public IP address serve a whole household of devices. Here is how it works, why the internet leaned on it so heavily, and the trade-offs it brings.

Right now, the phone in your pocket, the laptop on the table and the smart speaker in the corner might all be online at the same time — yet to the rest of the internet, they can look like a single connection. The technology making that possible is NAT, or Network Address Translation. It is one of the most widely used and least understood pieces of everyday networking, running silently inside almost every home router on the planet.

To follow how NAT works, it helps to know that your devices carry two different kinds of address. Our guide to public versus private IP addresses covers this fully, but here is the short version: inside your home, each device has a private address like 192.168.1.24, while your whole network shares one public address like 192.0.2.1 that the outside world sees. NAT is the machinery that bridges those two worlds.

What NAT does, in plain terms

Imagine your home network is an office building with one shared street address, and the receptionist at the front desk is your router. When an employee inside sends a letter out, the receptionist puts the building's street address on it as the return address and jots down who sent it. When a reply arrives at the building, the receptionist checks those notes and hands the letter to the right employee. Nobody outside ever needs to know the internal desk numbers.

That is Network Address Translation. As data leaves your network, the router rewrites the private source address on each packet to its own public address. As replies come back, it rewrites them again so they reach the correct device. The translation happens thousands of times a second and you never see it.

How NAT actually keeps track

A single public address serving dozens of devices raises an obvious question: when a reply arrives at 192.0.2.1, how does the router know whether it belongs to the laptop or the phone? The answer is ports.

Every connection uses a port number alongside the address, and the router builds a translation table that pairs each internal device and its port with a unique port on the public side. This flavour of NAT — by far the most common in homes — is called PAT (Port Address Translation) or "NAT overload," because it overloads one address across many connections using ports to tell them apart. If ports are new to you, our explainer on what a network port is is a helpful companion.

When a reply arrives addressed to 192.0.2.1:40002, the router looks it up, sees it belongs to the phone, rewrites the destination back to 192.168.1.31:49500, and forwards it on. The whole dance is handled by your home router.

Why the internet came to rely on NAT

NAT was not part of the internet's original design. It rose to prominence for one urgent reason: the world was running short of IPv4 addresses. With only about 4.3 billion possible IPv4 addresses and billions of devices coming online, giving every gadget its own public address was never going to work. Our article on IPv4 address exhaustion tells that story in full.

NAT was the pressure valve. By letting an entire household or business hide behind a single public address, it slashed demand for public addresses almost overnight and bought the internet years of breathing room while a long-term successor, IPv6, was rolled out. It is no exaggeration to say NAT is a big part of why IPv4 has lasted as long as it has.

The trade-offs NAT brings

NAT is enormously useful, but it is a workaround, and workarounds have costs.

It breaks the "any device can reach any device" ideal

The early internet imagined every machine being directly reachable. NAT quietly ended that. A device tucked behind NAT can freely start connections outward, but the outside world cannot easily start a connection in, because there is no obvious device for an unexpected incoming packet to go to.

It complicates certain apps

Some applications — online games, video calls, and peer-to-peer file sharing — need incoming connections to work well. To cope, they use tricks with names like port forwarding (manually telling the router which internal device should receive traffic on a given port), UPnP (letting apps request that automatically), and NAT traversal techniques such as STUN and hole punching.

It is not a real firewall

Because NAT blocks casual unsolicited inbound traffic, it looks a little like a firewall, and that side effect is genuinely useful. But it was never designed as a security control and should not be treated as one. A proper firewall makes deliberate decisions about what to allow; NAT simply has nowhere to send unexpected packets.

Carrier-grade NAT: NAT at internet scale

As addresses grew scarcer, some providers took the idea further with Carrier-Grade NAT (CGNAT). Here, the provider places many customers behind a shared pool of public addresses, so even your "public" address may in fact be shared with strangers. CGNAT stretches the address supply even further, but it deepens the same downsides: hosting a server from home or running certain peer-to-peer apps becomes harder, because you no longer control a public address of your own.

NAT and the future

The clean, long-term answer to the address shortage that made NAT necessary is IPv6, whose address space is so vast that every device can have its own public address again. On IPv6, the address-sharing purpose of NAT largely disappears, though firewalls still guard the front door. During the long transition, though, NAT remains a fixture of everyday networking, quietly translating away inside billions of routers.

So the next time your phone, laptop and TV are all streaming happily at once, you can thank NAT for the sleight of hand. Want to see the single public address they are all sharing? Pop over to IP Animals and take a look.