# NAT Explained in 5 Minutes: The Internet's Address Translator # NAT Explained in 5 Minutes: The Internet's Address Translator > **TL;DR** > > **Network Address Translation (NAT)** allows devices using private IP addresses to communicate with the public Internet by translating private addresses into public ones and keeping track of each connection. * * * ## The Problem Imagine every laptop, phone, server, and IoT device needed its own unique public IP address. The Internet simply doesn't have enough IPv4 addresses for that. Instead, most networks use **private IP addresses**, which are not routable on the Internet. For example, a typical home network might have: ```plaintext Laptop: 192.168.1.10 Phone: 192.168.1.11 Smart TV: 192.168.1.12 ``` These addresses work perfectly inside your home network — but Internet routers ignore them completely. As far as the wider Internet is concerned, they don't exist. So how can three separate private devices all reach the public Internet — and how does a reply know which one of them to come back to? That's where NAT comes in. * * * ## What NAT Does NAT sits between a private network and the Internet. When a device sends traffic: 1. It replaces the private source IP with a public IP. 2. It remembers the mapping. 3. When the response returns, it restores the original private address. ```plaintext Private Network Laptop: 192.168.1.10 ↓ +----------------+ | NAT | | Public IP | | 203.0.113.5 | +----------------+ ↓ Internet ``` To the Internet, every request from this network appears to come from the same address: ```plaintext 203.0.113.5 ``` Internally, NAT knows exactly which private machine actually initiated each request — even when several of them are talking to the Internet at the same time. * * * ## A Simple Example Suppose your laptop has: ```plaintext Private IP: 192.168.1.10 ``` You open a connection to a server out on the Internet. Your packet initially looks like this: ```plaintext Source: 192.168.1.10:51000 Destination: 198.51.100.42:443 ``` The NAT router changes it to: ```plaintext Source: 203.0.113.5:61001 Destination: 198.51.100.42:443 ``` When the reply arrives: ```plaintext Destination: 203.0.113.5:61001 ``` NAT checks its translation table: ```plaintext 61001 ↓ 192.168.1.10:51000 ``` and forwards the packet back to your laptop. The server never learns your laptop's private address — it only ever sees `203.0.113.5:61001`. That's straightforward enough with one device. The interesting part is what happens when your phone and your smart TV are doing the exact same thing, through the exact same public IP, at the exact same time. **👉 Try it yourself:** the widget below shows all three devices — laptop, phone, and smart TV — sharing that one public address simultaneously, with NAT rewriting each connection and routing every reply back to the right device by port number. %%[api-and-web-development--how-nat-made-the-growth-of-the-internet-possible--interactive] * * * ## The NAT Translation Table Here's what the router's translation table looks like for the three devices you just watched above: | Private Address | Public Address | | --- | --- | | 192.168.1.10:51000 | 203.0.113.5:61001 | | 192.168.1.11:51500 | 203.0.113.5:61002 | | 192.168.1.12:52000 | 203.0.113.5:61003 | Same public IP every time. Different port per device. That one table is the entire trick — it's how hundreds or thousands of devices can share a single public IP without ever colliding. * * * ## Why Ports Matter Notice something interesting: The public IP is always the same. Only the **port number** changes. ```plaintext 203.0.113.5:61001 (laptop) 203.0.113.5:61002 (phone) 203.0.113.5:61003 (smart TV) ``` This is called **Port Address Translation (PAT)**. PAT is the form of NAT used almost everywhere today. Without ports, every internal machine would require its own public IP — and we'd be right back to the original problem. * * * ## Types of NAT ### Static NAT One private IP permanently maps to one public IP. ```plaintext 10.0.1.15 ↓ 203.0.113.15 ``` Useful for servers that always need the same public address. * * * ### Dynamic NAT A pool of public addresses is available. Each private machine gets one temporarily. ```plaintext Pool: 203.0.113.10 203.0.113.11 203.0.113.12 ``` Less common today. * * * ### PAT (Most Common) Many private machines share one public IP using different ports — exactly what you saw above: ```plaintext Laptop, Phone, Smart TV ↓ 203.0.113.5 (one shared IP, three different ports) ``` Almost every home router works this way. * * * ## NAT in AWS AWS uses NAT frequently. A common architecture looks like this: ```plaintext Internet ↓ Internet Gateway ↓ NAT Gateway ↓ Private Subnet EC2 ECS EKS RDS ``` Instances inside the private subnet can: * download software * call external APIs * access AWS services But they **cannot receive unsolicited inbound connections** from the Internet. This is a major security benefit. * * * ## Why NAT Improves Security NAT is **not a firewall**, but it provides an important layer of protection. Because external systems do not know about private addresses, they cannot initiate connections directly to internal machines. Only connections that originated from inside are automatically allowed back — the same way NAT only forwarded that reply back to your laptop because your laptop was the one that opened the connection. This greatly reduces the attack surface. * * * ## NAT Is Stateful NAT remembers every active connection. Example: ```plaintext Laptop ↓ HTTPS request ↓ NAT creates entry ↓ Server replies ↓ NAT forwards response ``` Once the connection ends, the entry disappears. * * * ## Common Misconception Many people think NAT and firewalls are the same thing. They are not. | NAT | Firewall | | --- | --- | | Translates addresses | Filters traffic | | Keeps connection mappings | Enforces security rules | | Makes private IPs Internet-accessible | Allows or blocks packets | | Does not decide what is allowed | Controls what is permitted | Most routers implement both. * * * ## Limitations of NAT NAT isn't perfect. Some downsides include: * Breaks true end-to-end connectivity. * Makes peer-to-peer applications more complex. * Complicates troubleshooting. * Can interfere with protocols that embed IP addresses inside payloads. * Requires techniques like NAT traversal for some real-time applications. * * * ## IPv6 and NAT One of IPv6's goals was to eliminate the need for NAT. IPv6 provides approximately: ```plaintext 340 undecillion addresses 340,282,366,920,938,463,463,374,607,431,768,211,456 ``` That's enough for every device to have its own globally unique address — no translation table required, no shared IP, no port juggling. Even so, NAT is still extremely common because most of today's Internet continues to rely heavily on IPv4. * * * ## Interview Questions ### Why is NAT needed? Because private IP addresses cannot be routed across the public Internet, NAT translates them into public addresses. * * * ### Why can thousands of devices share one public IP? Because NAT uses different TCP/UDP port numbers to distinguish each connection. * * * ### Does NAT replace a firewall? No. NAT translates addresses. Firewalls enforce security policies. * * * ### Why are AWS private subnets usually paired with a NAT Gateway? So instances can initiate outbound Internet connections without being directly reachable from the Internet. * * * ## Key Takeaways * NAT translates private IP addresses into public IP addresses. * Most NAT implementations use **Port Address Translation (PAT)**. * Thousands of devices can share a single public IP. * NAT hides internal addressing from the Internet. * NAT is stateful but is **not** a firewall. * AWS NAT Gateways provide outbound Internet access for private subnets. * IPv6 reduces the need for NAT but IPv4 NAT remains widely used. * * * ## What's Next? In the next **Quick Guides** article, we'll explore **CIDR notation**—how IP address ranges are represented, why `/24` and `/16` matter, and how subnetting works in practice.