What Is NAT? Network Address Translation Explained

NAT, or network address translation, lets many devices share one public IP address. Your router keeps a table of which device started each connection, swaps the device's private address for the public one on the way out, and swaps it back when the reply arrives. That is why every phone and laptop in your home shows the same address on our IP checker, even though each has its own address on your network.

How does NAT work?

NAT rewrites the addresses in each packet as it passes through the router. When your laptop at 192.168.1.20 opens a connection from port 51000, the router replaces that pair with its own public address and a port it chooses, and writes the pairing down. When the website answers on that public port, the router looks up the pairing and forwards the reply to the laptop. RFC 3022 calls this Network Address Port Translation (NAPT), and it is what nearly every home router does.

Step	Source address seen
Laptop sends a request	192.168.1.20 port 51000 (private)
Router forwards it to the internet	Your public IP, port chosen by the router
Website replies	To your public IP and that port
Router hands the reply back	To 192.168.1.20 port 51000

Why does NAT exist?

IPv4 has only 32-bit addresses, about 4.3 billion in total, which is far fewer than the devices now online. NAT lets a home or office use addresses from the private ranges set aside in RFC 1918 (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16), which anyone can reuse, and present a single public address to the internet. Our guide to public and private IP addresses covers those ranges in detail.

Types of NAT

Basic NAT maps private addresses to a pool of public ones, one to one. RFC 3022 describes it, but it needs as many public addresses as active devices, so homes rarely use it.
NAPT, often called PAT or NAT overload, maps many private addresses to one public address by also translating port numbers. This is the NAT in your router.
Static NAT, or port forwarding, is a fixed rule that sends traffic arriving on a public port to one device inside.
Carrier-grade NAT (CGNAT) is NAT run by your provider, which shares one public address between many customers. It uses the 100.64.0.0/10 range from RFC 6598 between the provider and your router.
Double NAT is two layers of NAT in your own home, for example your own router plugged in behind the provider's router.

Why does NAT block incoming connections?

A router only has a mapping for connections that a device inside started. A packet that arrives unasked matches no entry, so the router does not know which device it is for and drops it. RFC 3022 notes that sessions in the other direction are allowed only through static mappings. That is why hosting a game server, a camera or remote desktop at home needs port forwarding, and why it fails entirely behind CGNAT.

Calls, games and video apps get around this with NAT traversal: each side asks a public STUN server (Session Traversal Utilities for NAT, port 3478 in the port registry) which public address and port it appears to have, then they try to reach each other directly.

Is NAT a firewall?

No, although it acts a little like one. NAT was designed to save addresses, and the fact that it drops unsolicited traffic is a side effect. A port you forward is open to the whole internet, and NAT does nothing to inspect the traffic that is allowed through. Keep the firewall on your router and devices switched on.

Does IPv6 need NAT?

Usually not. IPv6 addresses are 128 bits long, enough for every device to have its own public address, so a home router hands out real IPv6 addresses and uses its firewall to decide what may come in. Read what IPv6 is for how those addresses work.

How to tell whether you are behind NAT

Find your device's own address: run ipconfig on Windows or look in the Wi-Fi details on a phone or Mac.
Compare it with the public address on our IP checker.
If your device shows a private address such as 192.168.x.x or 10.x.x.x and the checker shows something else, your router is doing NAT. That is normal.
To see whether your provider adds a second layer, compare your router's WAN address with the public address, as the CGNAT guide explains.

Frequently asked questions

What is NAT in simple terms?

It is the job your router does so that all your devices can share one internet address. It changes the address on outgoing traffic to its own, remembers who asked, and passes the replies back to the right device.

What is the difference between NAT and PAT?

PAT, port address translation, is the common form of NAT that also changes port numbers so many devices can share one public address. RFC 3022 calls it NAPT. When people say NAT about a home router, they almost always mean PAT.

What is double NAT and is it a problem?

Double NAT is two routers each doing NAT, one behind the other. Browsing works, but port forwarding and some games break unless you forward ports on both routers or put the first one into bridge mode.

Does NAT hide my IP address?

It hides your device's private address, but websites still see your public address. To change what sites see, read how to hide your IP address.

Sources and further reading

Try it yourself

See the real numbers for your own connection with our free tools.