What Is NAT?
Network Address Translation is a router-level function that maps private IP addresses used inside a local network to a single (or small pool of) public IP address used on the internet. It was standardized as "Traditional NAT" in RFC 3022, building on the private address space defined in RFC 1918.
Per RFC 1918, three IP ranges are reserved for private networks and never routed on the public internet:
10.0.0.0/8(10.0.0.0–10.255.255.255)172.16.0.0/12(172.16.0.0–172.31.255.255)192.168.0.0/16(192.168.0.0–192.168.255.255)
Every device behind your router gets an address from one of these ranges — check yours with the Subnet Calculator. When a packet from that device leaves the router toward the internet, NAT rewrites the source address (and source port) to the router's single public IP before forwarding it. The router keeps a translation table so replies get routed back to the correct internal device.
This solved two problems at once: it stretched the ~4.3 billion IPv4 addresses to cover many times that many devices, and it gave home networks an incidental security boundary — unsolicited inbound packets have no matching table entry, so they're dropped by default.
How NAT Works
Consider a laptop at 192.168.1.10 requesting example.com. The sequence:
- Outbound packet leaves the laptop: source
192.168.1.10:52341→ destination93.184.216.34:443. - Router rewrites the source: the NAT table swaps the source to the router's public IP and a new source port, e.g.
203.0.113.5:61024→ destination unchanged. - Router records the mapping:
192.168.1.10:52341 ↔ 203.0.113.5:61024for that connection. - Reply arrives:
example.comsends its response to203.0.113.5:61024. - Router reverses the translation: looks up the table, rewrites the destination back to
192.168.1.10:52341, and forwards it to the laptop.
This per-connection, per-port bookkeeping is what makes NAT stateful — it only works for connections the internal host initiated. That's also why unsolicited inbound traffic (someone trying to reach your laptop directly) has no table entry to match and gets dropped, unless you've explicitly configured port forwarding.
Types of NAT
Different NAT modes handle the internal-to-external mapping differently. Verify which ports are actually reachable through your setup with the Port Scanner.
| Type | Mapping | Use Case | Public IPs Needed |
|---|---|---|---|
| Static NAT | One private IP ↔ one fixed public IP, permanent | Hosting a server that needs a stable public address | 1 per internal host |
| Dynamic NAT | One private IP ↔ one public IP, pulled from a pool | ISPs/enterprises with a pool of public IPs to share | Pool size < host count |
| PAT (NAT Overload) | Many private IPs ↔ one public IP, distinguished by port | Home/office routers — the default on nearly every consumer router | 1 total |
| CGNAT (Carrier-Grade NAT) | Many customers ↔ shared public IP pool, at the ISP | Mobile carriers, ISPs facing IPv4 exhaustion | Shared across many customers |
| NAT64 | IPv6-only client ↔ IPv4 server, protocol-translated | IPv6-only networks reaching legacy IPv4-only services | N/A (protocol bridge) |
PAT (Port Address Translation), also called NAT overload, is what your home router runs: it distinguishes each internal device's traffic by allocating a unique source port per connection, drawn from the ephemeral port range (1024–65535), so one public IP can serve an entire household. CGNAT takes this further at the ISP level, using the shared address space 100.64.0.0/10 reserved specifically for that purpose in RFC 6598 — meaning your "public" IP from a mobile carrier is often itself behind another layer of NAT you don't control, which is why some inbound connections (self-hosting, certain P2P apps) fail entirely on CGNAT connections no matter how you configure your own router.
Is NAT a Firewall?
No — NAT is not a firewall, though it produces a firewall-like side effect. Because NAT only creates translation entries for connections initiated from inside the network, unsolicited inbound packets are dropped by default. That's a byproduct of statefulness, not access control. NAT has no concept of rules, ports policies, deep packet inspection, or logging — it doesn't inspect payloads, block malicious traffic on allowed ports, or protect against attacks that ride on a connection you initiated (like a malicious download). Run a real perimeter check with the DNSnexus Security Tools rather than relying on NAT alone; see our home network security guide for a proper baseline.
Common NAT Problems
Double NAT. This happens when two devices in the chain both perform NAT on the same traffic — typically an ISP modem/gateway in router mode plus your own router behind it, each handing out private addresses. Symptoms: port forwarding configured correctly on your router still fails, because the ISP device's NAT layer never forwards the port through to your router in turn. Fix: put the ISP-provided modem/gateway into bridge mode (or pure modem mode) so only your own router performs NAT, or forward the same port on both devices if bridge mode isn't available.
Symmetric NAT breaking VoIP and gaming. Symmetric NAT allocates a different external port for every distinct destination a device talks to, rather than reusing one external port per internal socket. Protocols like SIP (VoIP) and STUN-based NAT traversal (used by game consoles and video calls) assume the external port stays constant across destinations — when it doesn't, connections fail or one-way audio/video results. This is exactly what Xbox, PlayStation, and Steam report as "NAT Type: Strict" — it's symmetric NAT under the hood, versus "Open" for a full-cone NAT that doesn't vary the port per destination.
CGNAT blocking inbound connections entirely. If your ISP places you behind CGNAT (100.64.0.0/10), you don't have a real public IP to forward ports to — no router-level fix exists short of requesting a dedicated public IP from your ISP or using a reverse tunnel/VPN service.
How to Check Your NAT Setup
- Check your public-facing IP with What Is My IP and compare it to your router's WAN IP (in the router admin panel) — if they differ, you're behind an extra layer of NAT (likely CGNAT or a double-NAT ISP gateway).
- Look up ownership and routing details for that public IP with IP Lookup — CGNAT ranges typically resolve to the ISP itself rather than a static allocation to your account.
- Find your router's private gateway address with our router IP address guide, and confirm your internal devices fall inside one of the RFC 1918 ranges using the Subnet Calculator.
- Test whether a specific port is actually reachable from outside with the Port Scanner after configuring port forwarding — don't assume the router's UI accepted the rule correctly.
- If a hop count or unexpected router shows up mid-path, trace it with Online Traceroute to confirm whether an extra NAT/gateway hop exists.
Key Takeaways
- ✓ NAT rewrites IP addresses (and usually ports) so private-range devices (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) can share one public IP.
- ✓ PAT (NAT overload) — one public IP, many internal hosts distinguished by port — is the default on nearly every home router.
- ✓ NAT is not a firewall; its blocking of unsolicited inbound traffic is a side effect of statefulness, not a security policy.
- ✓ Double NAT (ISP gateway + your own router both NAT'ing) is the most common cause of failed port forwarding — bridge mode fixes it.
- ✓ CGNAT (RFC 6598, 100.64.0.0/10) means your ISP is NAT'ing you along with other customers, and no router-side setting can open inbound ports through it.
Frequently Asked Questions
Q: What is NAT in simple terms?
NAT (Network Address Translation) is what lets multiple devices on your home network share one public IP address by rewriting the private IP and port of outgoing packets to your router's public IP, then reversing that rewrite for the replies.
Q: What are the types of NAT?
The main types are Static NAT (fixed one-to-one mapping), Dynamic NAT (one-to-one from a pool), PAT/NAT overload (many-to-one via ports — the home router default), CGNAT (ISP-level shared NAT), and NAT64 (protocol translation between IPv6 and IPv4 networks).
Q: Is NAT a firewall?
No. NAT drops unsolicited inbound packets only because they have no matching connection entry in its translation table — that's a side effect of how NAT works, not an access-control policy like a real firewall enforces.
Q: What is the difference between NAT and PAT?
NAT (in the static/dynamic sense) maps one private IP to one public IP. PAT (Port Address Translation, aka NAT overload) maps many private IPs to a single public IP by distinguishing each connection with a unique port — it's the specific type of NAT almost every consumer router actually runs.
Q: Why does port forwarding fail even after I configure it correctly?
The most common cause is double NAT — your ISP's modem/gateway is also running NAT ahead of your own router. Put the ISP device into bridge mode so only your router handles NAT, then reconfigure the port forward.
Q: Does NAT slow down my internet connection?
NAT adds negligible latency on modern routers — the address/port rewrite is a fast table lookup. Perceived slowdowns are almost always from other causes (Wi-Fi congestion, ISP throttling, or CGNAT adding an extra hop), not the NAT translation itself.
Q: What is CGNAT and how do I know if I'm behind it?
Carrier-Grade NAT (CGNAT) is NAT run by your ISP, sharing one public IP across many customers using the reserved 100.64.0.0/10 range (RFC 6598). Compare your router's WAN IP to what What Is My IP reports — if they don't match, or your WAN IP falls in 100.64.0.0/10, you're behind CGNAT and can't forward ports without ISP intervention.
Next Steps
Verify your own network's NAT layer with What Is My IP and IP Lookup, confirm your private subnet with the Subnet Calculator, and test whether a forwarded port is actually reachable with the Port Scanner.