NAT Explained: How Network Address Translation Works

If you're reading this, you're behind NAT right now. Your device has a private IP like 192.168.1.25 — not routable on the public internet — yet here you are, browsing the web. Network Address Translation (NAT) maps private addresses to one or more public IPs, letting entire networks share a single public IP.

Why Do We Need NAT?

There are only ~4.3 billion IPv4 addresses — far fewer than the number of devices on the internet. The solution: private IP ranges anyone can use internally, translated to a public address only when traffic leaves the local network.

How NAT Works: Step by Step

• 1. An internal device sends a packet with source 192.168.1.25:54321 → destination 142.250.80.46:443
• 2. The NAT router creates a translation entry, rewrites the source IP to its public IP and a new ephemeral port, then forwards it
• 3. The destination server sees traffic coming from the public IP and ephemeral port — it has no idea about the private address
• 4. The response comes back to the public IP/port; the NAT router looks up its table, finds the original private IP/port, and rewrites the destination
• 5. The internal device receives the response as if it spoke directly to the server

The Three Types of NAT

1. Static NAT (One-to-One)

Maps one private IP to one public IP permanently. Used for servers that need to be reachable from the internet with a consistent address. Consumes one public IP per device — doesn't solve address exhaustion.

2. Dynamic NAT (Many-to-Many)

Maps private IPs to public IPs from a pool, first-come first-served. Still needs at least as many public IPs as simultaneous users, and inbound connections aren't possible. Rarely used today.

3. PAT — Port Address Translation (Many-to-One)

Also called NAT Overload or IP Masquerading — the "home router NAT." Maps many private IPs to a single public IP, distinguished by port numbers. A single public IP can support thousands of simultaneous connections.

Internal (IP:Port)    Translated (IP:Port)   Destination
192.168.1.25:54321 → 203.0.113.5:30000     8.8.8.8:443
192.168.1.25:54322 → 203.0.113.5:30001     142.250.80.46
192.168.1.26:49152 → 203.0.113.5:30002     1.1.1.1:53

NAT and the CompTIA Network+ Exam

NAT appears in Domain 1.0 (Networking Fundamentals) and Domain 2.0 (Network Implementations). You'll need to know:

• The difference between NAT, static NAT, dynamic NAT, and PAT
• RFC 1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• When to use each type — static for servers, PAT for general internet access

Port Forwarding

PAT breaks inbound connectivity — outside devices can't initiate connections because the router doesn't know which internal device should receive the traffic. Port forwarding solves this: Forward WAN port 80 → LAN 192.168.1.10:80 tells the router exactly where to send traffic arriving on that port.

Common NAT Issues

Test Your Knowledge