NAT (Network Address Translation)
NAT translates private IP addresses to public IP addresses at a router boundary. NAT allows many devices to share one public IP. It breaks end-to-end connectivity – inbound connections require port forwarding. Carrier-grade NAT (CGNAT) adds another translation layer, complicating VoIP and gaming.
Definition
Network Address Translation rewrites packet headers at a router, mapping private addresses (10.x, 172.16-31.x, 192.168.x) to public addresses. Source NAT (SNAT/masquerade) rewrites the source IP on outgoing packets and maintains a connection tracking table to route responses back. Destination NAT (DNAT/port forwarding) maps incoming connections on specific ports to internal servers. PAT (Port Address Translation) is the most common form – thousands of internal hosts share one public IP by varying source ports. NAT breaks protocols that embed IP addresses in payloads (SIP, FTP active mode) – ALG (Application Layer Gateway) modules handle this. IPv6 was designed to eliminate NAT by providing enough addresses for every device, but NAT66 exists for IPv6 networks that want address hiding.
Examples
- –iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
- –conntrack -L shows the NAT connection tracking table
- –iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.1.10:80
Related Protocols
Related Terms
Subnet
A subnet is a logical division of an IP network defined by a subnet mask (e.g., /24 = 255.255.255.0). Hosts within a subnet communicate directly via ARP without routing. Hosts in different subnets must send traffic through a router. Subnetting reduces broadcast domains and enables hierarchical IP allocation.
Gateway (Default Gateway)
A default gateway is the router a host sends packets to when the destination is not on the local subnet. Every host needs a default gateway to reach the internet or other networks. If the gateway is unreachable, all off-subnet communication fails – even if the host has a valid IP and DNS.