Home › Resources › NAT

Executive Summary

Network address translation, or NAT, lets devices with private IP addresses share one or more public addresses when communicating with the internet. It was created to conserve scarce IPv4 addresses and remains widespread today. NAT also incidentally hides internal addressing, but it should not be mistaken for a security control on its own.

What It Is

NAT is a technique, usually performed by a router or firewall, that rewrites the IP address information in packets as they cross a boundary between a private network and a public one. Internal devices use private IP addresses from reserved ranges that are not routable on the public internet, and NAT translates those into a public address when traffic leaves, then reverses the translation for the replies. The most common form is port address translation, sometimes called NAT overload, where many internal devices share a single public IP and are distinguished by unique port numbers. NAT keeps a translation table so it can match returning traffic to the correct internal device.

Why It Matters

NAT solved a real scarcity problem: the IPv4 address space is too small for every device to have its own public address, and NAT let entire homes and organizations operate behind a handful of public addresses. It remains everywhere, from home routers to enterprise edges and cloud gateways. NAT also means internal devices are not directly reachable from the internet unless a rule explicitly forwards traffic to them, which reduces exposure as a side effect. However, treating NAT as a firewall is a mistake, because it does not inspect or filter traffic by policy. Understanding what NAT does and does not provide is important for designing and troubleshooting networks.

How It Works

When an internal device sends a packet to the internet, the NAT device replaces the packet's private source address (and, in port address translation, the source port) with its public address and a chosen port, and records that mapping in a translation table. The destination server sees only the public address and replies to it. When the reply arrives, the NAT device consults its table, restores the original private address and port, and forwards the packet to the correct internal device. For inbound connections that must reach an internal server, an administrator configures port forwarding or a static translation so specific external traffic is directed inside. IPv6, with its vast address space, reduces the need for NAT but does not eliminate translation entirely.

Architecture Diagram

Visual Workflow

Common Attacks

• Exploiting overly permissive port-forwarding rules to reach internal services
• Assuming NAT provides protection and leaving forwarded services unpatched
• NAT slipstreaming techniques that trick a NAT device into opening a path inside
• Overwhelming the translation table to disrupt connectivity
• Pivoting from an exposed forwarded host deeper into the internal network

Common Mistakes

• Treating NAT as a substitute for a real firewall and access policy
• Forwarding more ports than necessary and exposing internal systems
• Forgetting that NAT does not inspect or filter traffic content
• Overlapping private address ranges when connecting networks together
• Assuming internal devices are invisible when a forwarding rule exposes them

Best Practices

• Pair NAT with a stateful firewall that enforces an actual access policy
• Forward only the specific ports required and document each rule
• Patch and harden any internal service exposed through port forwarding
• Plan private address ranges to avoid overlap when networks are joined
• Monitor for unexpected inbound rules and unusual translation activity

Quick Checklist

• A stateful firewall enforces policy alongside NAT
• Every port-forwarding rule maps to a documented need
• Services exposed through NAT are patched and hardened
• Private address plans avoid overlap across connected networks
• Inbound rules and translation activity are reviewed regularly

Recommended Tools

Industry Standards

Career Relevance

NAT is fundamental knowledge for network security engineers, security engineers, and cloud security engineers, who design address plans, configure gateways, and set up secure inbound access. SOC analysts account for NAT when tracing traffic back to a specific internal host. Understanding NAT is essential for reading network diagrams and logs, a routine task across the roles that AI-Governance-Jobs.com serves.

Interview Questions

• What problem was NAT originally designed to solve?
• What is the difference between basic NAT and port address translation?
• Why is NAT not a substitute for a firewall?
• How does port forwarding expose an internal service, and how do you secure it?
• How does the wide address space of IPv6 change the need for NAT?

Related Certifications

Further Reading

• IETF RFC 1918: Address Allocation for Private Internets
• IETF RFC 3022: Traditional IP Network Address Translation
• NIST Computer Security Resource Center

FAQ