Also: NAT, network address translation, port forwarding, PAT, masquerading
Network address translation rewrites the addresses and ports in packets as they cross a network boundary, most commonly so that many devices with private addresses can share one public address to reach the internet.
Our take. NAT is a workaround that became load-bearing. It was invented to stretch a dwindling supply of addresses and it is now treated as a security feature, which it is not: it hides devices by accident, breaks protocols by design, and IPv6 makes it unnecessary. Understand it thoroughly, because you will meet it everywhere, and do not mistake it for a firewall.
A home or office network uses private addresses that mean nothing on the public internet. When a device inside sends a packet out, the router at the edge replaces the private source address with its own public one, changes the source port to something unique, and records the mapping in a table. The reply arrives at the public address and that port; the router looks up the table, restores the private address and original port, and forwards the packet inside. Thousands of devices share one public address this way, distinguished by port, and the outside world sees one host. The design was a stopgap for address exhaustion, and it has been the way most networks reach the internet for a quarter of a century.
What it breaks is anything that needs an inbound connection or that embeds addresses in its payload. A device inside cannot be reached from outside unless the router is told in advance to forward a particular port to it, which is port forwarding, and protocols that write their own address into the data they send, some voice and file-transfer protocols among them, arrive with an address that means nothing to the receiver and need helper logic on the router to repair them. Peer-to-peer applications spend enormous effort discovering and punching through translation. None of this exists on IPv6, where each device holds its own public address and the router filters rather than rewrites.
Kind
What is rewritten
Used for
Source translation with port mapping
Many private sources to one public address, distinguished by port
Almost every home and office internet connection
Static one-to-one
One private address to one public address, both directions
A server that must be reachable inside and out
Port forwarding
One public port to one private address and port
Exposing a single internal service
Destination translation
The destination of inbound traffic, to a different internal target
Load balancers and reverse proxies at the edge
Carrier-grade
A second layer of translation inside the internet provider
Providers who have run out of public addresses for customers
In practice
A small business believes its servers are safe because they sit behind the router's translation and have no public addresses. An employee opens a phishing attachment; the malware inside makes an outbound connection to the attacker's server, which translation permits without question, because outbound is what it is for. The attacker now has a channel into the network that the translation table maintains for them, and reaches the servers from the compromised laptop. Translation hid the servers from unsolicited inbound scans and did nothing about a connection initiated from inside. A firewall with an outbound policy, and segmentation between users and servers, would have; the router's address rewriting was never designed to.
A firewall filters traffic by rule in both directions; translation rewrites addresses and incidentally blocks unsolicited inbound connections. The incidental effect is not a policy, and outbound traffic passes translation unexamined.
Routing decides where a packet goes; translation changes what the packet says about its source or destination. The same edge device usually does both, in sequence, and they are separate operations.
Private address ranges are the reason translation exists: they are reused in every network and cannot appear on the public internet. Addressing defines the ranges; translation is the mechanism that lets them out.
Key takeaways
→One public address, many private devices, told apart by port; a table at the edge does the rewriting.
→It breaks inbound connections and address-carrying protocols; port forwarding and helpers patch around that.
→It is not a firewall: outbound passes unexamined, and IPv6 removes the need for it.
Certifications that test this
Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
.NET is a modern, innovative, open source development platform and developers love it. NET best suits businesses that l…
Udemy
FAQ
Is NAT a security feature?
No, though it has a side effect that resembles one: devices behind it cannot be reached by unsolicited inbound connections. It does nothing about outbound connections, which is how most compromises operate, and nothing about traffic between devices inside. A firewall is the control; translation is address arithmetic.
Why does my video call or game need port forwarding?
Because the other party needs to reach your device directly, and translation only permits replies to connections you started. Forwarding a port tells the router to send inbound traffic on that port to your device; newer protocols negotiate this automatically, with varying success.
Does IPv6 use NAT?
By design, no. Every device can hold a public address, the router filters rather than rewrites, and the workarounds translation forced disappear. Some organisations translate IPv6 anyway out of habit; the standards discourage it.
Sources
The primary text this definition rests on. Read it before you trust ours.
