Network Address Translation
Network Address Translation (NAT) rewrites IP addresses as traffic crosses a router or gateway. A common home or office setup lets several devices with private addresses share one public IP address for Internet connections. The company supplying that connection is an Internet Service Provider (ISP).
Internet traffic travels in small units called packets. An ordinary router passes packets toward their destination. A NAT gateway also passes them on, but rewrites addresses and often port numbers. A port helps distinguish an application or exchange of data at an IP address. An application proxy works differently: it accepts the client's connection and opens a separate connection to the destination. The destination therefore sees the proxy as the system connected directly to it, or immediate peer.
A website sees the translated public address of the NAT gateway, not the private address assigned to the user's device. That public IP usually identifies an Internet connection, site, or gateway, which may still serve many devices and users.
NAT is the broad term for rewriting network addresses. The common form that lets several devices share one public address also rewrites port numbers. It is formally called Network Address and Port Translation (NAPT), and is also commonly called Port Address Translation (PAT). This guide uses the familiar term NAT for that shared-address setup unless the distinction matters. When a broadband or mobile provider shares public addresses across customers, that is Carrier Grade NAT.
How does NAT translate a private address to a public address?
Private addresses such as 192.168.1.42, 10.20.30.40, and 172.16.5.23 are valid and may be routed inside a local network, but they are not intended to be globally routed or to legitimately appear on the public Internet. A NAT device rewrites the connection so the public server sees a public source IP address instead. See Private IP address ranges for their exact boundaries.
In this diagram, 198.51.100.20 and 203.0.113.10 are reserved documentation addresses standing in for public addresses. They are not real public Internet endpoints. The gateway keeps a temporary mapping from the internal device and port to the external public address and port. Replies from the server follow that mapping back to the right device. The source port lets the gateway keep simultaneous connections from different devices separate even when they use the same public IP.
How does NAT work on home, hotel, and office Wi-Fi?
On a home network, the router typically gives each device a private address through Dynamic Host Configuration Protocol (DHCP). A device can also use a static address or another configuration method. The router then translates outbound connections to the public IP address assigned by the ISP. A search from the living room laptop and a video call from a phone both appear to websites as the same public IP.
Hotel and office Wi-Fi work the same way at a larger scale. Many guests or employees sit behind the same firewall, captive portal, or gateway. A server log that records only the public IP points to the hotel, office, campus, or provider network, but not the individual device on that private network.
What is double NAT?
Double NAT means that a connection crosses two address-translation layers. It can happen when one customer-controlled router sits behind another router: the inner router translates device addresses, and the outer router translates the inner router's address again. Another common example is a home router behind an ISP's Carrier Grade NAT gateway.
Outbound connections usually work because each layer keeps its own temporary mapping. Inbound services are harder because every translation layer must have a matching inbound mapping and firewall rule.
How does ordinary port forwarding work?
A protocol defines how systems exchange information. TCP and UDP are transport protocols, each with its own port numbers. A manually configured port-forwarding rule creates a fixed rule (a static inbound mapping) on a NAT gateway. For example, a rule can send TCP connections arriving at the router's public address on port 443 to 192.168.1.20:443 on the private network. The gateway rewrites the destination address and port, then reverses that translation for replies.
The rule exposes only the configured protocol and port, and the firewall must also permit the traffic. It does not turn every private device into a public host or identify the original client. With double NAT, forwarding must be configured at every customer-controlled layer. If a provider controls the outer public mapping, read why port forwarding fails behind CGNAT.
What changes with IPv6?
IPv6 normally gives devices globally scoped addresses without using IPv4-style address sharing. An inbound IPv6 connection therefore does not usually need port forwarding, but it still needs a route and an explicit firewall policy that permits it. The absence of NAT does not mean that a device should be exposed or that IPv6 is less secure.
Translation still exists at some IPv4/IPv6 boundaries, including NAT64, and dual-stack networks can use NAT for IPv4 while routing IPv6 directly. Apply firewall, logging, and monitoring rules to both protocols. See IPv4 and IPv6 for dual-stack and transition behavior.
Why is NAT not a firewall?
NAT rewrites addresses and, commonly, ports. A firewall applies rules that permit or deny traffic. A home router often combines both, and its temporary NAT mappings can make unsolicited inbound connections harder to deliver, but that behavior is not a substitute for firewall policy, software updates, authentication, or encryption.
How should I read NAT evidence?
A translated public address identifies a gateway or Internet connection, not one person or device. Matching a connection to those gateway records normally requires an exact UTC timestamp, translated source IP and port, and transport protocol, together with the NAT device's mapping records. Retain the destination IP and port when available because they identify the exact flow. Capture the observed connection fields at the Internet-facing observation point. If your application is behind another intermediary, first follow How to Find the Real Client IP Behind a Proxy. For the full evidence checklist, see Logging best practices.