Skip to content
Knowledge Hub/Article
Article

What Is NAT? Network Address Translation, PAT and CGNAT

We explain how NAT maps private IP addresses to public ones, its types from static NAT to PAT and CGNAT, its limits and cloud NAT gateways.

Oğuzhan Gerçek··10 min read
What Is NAT? Network Address Translation, PAT and CGNAT

Short answer: NAT (Network Address Translation) changes a packet's IP address, and often its port number, as the packet passes from one network to another. With PAT, the form used in homes and organizations, devices with private addresses share a single public address on a router or firewall to reach the internet, and replies find their way back to the right device by port number. The main types are static and dynamic NAT, PAT, SNAT, DNAT and the CGNAT that internet service providers run. NAT bought time against IPv4 address exhaustion, but it is not a security control: protection comes from firewall rules.

What is NAT, and how does it work?

RFC 2663 (August 1999) defines NAT as a method by which IP addresses are mapped from one address realm to another, providing transparent routing to end hosts. According to RFC 3022 (January 2001), sessions in traditional NAT are unidirectional, outbound from the private network.

When an internal device opens a connection, the NAT device replaces the packet's source address with the public address and records the mapping in a translation table; when the reply arrives, it translates the packet back to the internal address in the table. According to NIST SP 800-41 Rev. 1, most firewalls can perform NAT, and hosts on the outside cannot initiate contact with hosts on the inside. NIST also says the logs must record the private address rather than the translated public one. There is a short definition in our glossary, and we cover the device that performs NAT in our router article.

Why does NAT exist? IPv4 address exhaustion

According to RFC 791, an IPv4 address is 32 bits long, which allows at most 2³², or roughly 4.3 billion, addresses. RFC 1918 (February 1996) set aside three address blocks for private networks, citing concern that globally unique address space would be exhausted; we list the blocks in our LAN article. Under the RFC, packets with private addresses should not be forwarded across inter-enterprise links, so these devices can only reach the internet if their addresses are translated on the way.

On February 3, 2011, the Number Resource Organization (NRO) announced that IANA had no IPv4 addresses left to allocate to the five Regional Internet Registries (RIRs). One of them, the RIPE NCC, made its final /22 allocation on November 25, 2019. The announcement noted the emergence of an IPv4 transfer market and greater use of CGNAT in the region, but said neither solves the underlying problem: there are not enough IPv4 addresses for everyone.

Types of NAT: static NAT, dynamic NAT and PAT

  • Static NAT: Maps one internal address to one external address, one-to-one and permanently. According to Cisco, it is mostly used for hosts that provide services such as mail, web or FTP.
  • Dynamic NAT: Maps internal addresses to addresses from a public pool; according to Cisco, it is useful when fewer addresses are available than hosts to translate. An entry is created when a host opens a connection and removed after a period without traffic.
  • PAT (NAPT, NAT overload): In RFC 3022's definition, many network addresses and their TCP/UDP ports are translated into a single network address and its TCP/UDP ports; the router uses the port number to send each reply to the right device (port article). According to the RFC, this model fits the requirements of most small office/home office (SOHO) users, who reach the internet with a single address assigned by their provider.

SNAT, DNAT and port forwarding

On Linux, NAT types are named after the address they change. According to Red Hat's documentation:

  • SNAT (source NAT): Rewrites the packet's source address to a specified address; this is how traffic gets out to the internet.
  • Masquerading: A form of SNAT that automatically uses the current address of the outgoing interface, which makes it the right choice when that address is dynamic.
  • DNAT (destination NAT): Rewrites the destination address and port of incoming packets, for example to make a web server with a private address reachable from the internet.

Port forwarding is also a DNAT rule; NIST calls the practice pinholing. In NIST's example, a policy that requires all HTTP servers accessible from the outside to be on the DMZ means the NAT must not pinhole TCP port 80 to the inside. We cover the DMZ in our firewall article.

Carrier-grade NAT (CGNAT) and 100.64.0.0/10

RFC 6888 (April 2013) defines CGNAT (carrier-grade NAT) as a NAT-based logical function used to share the same IPv4 address among several subscribers. When the subscriber's own router also performs NAT, traffic is translated twice; RFC 7021 (September 2013) calls this setup NAT444. For the links between the provider and subscriber equipment, RFC 6598 (April 2012) reserved 100.64.0.0/10 as Shared Address Space. The block is distinct from RFC 1918 space and can only be used in service provider networks, since addresses can collide when subscriber and provider use the same private range. CGNAT has two practical consequences:

  • Inbound connections get harder: In RFC 7021's tests, peer-to-peer applications and FTP sessions to servers inside the home ran into problems.
  • Logs need more detail: An IP address alone no longer identifies a subscriber. RFC 6302 (June 2011) recommends that internet-facing servers also log the source port and a timestamp in UTC, accurate to the second (log article).

NAT is not a firewall

Because outside hosts cannot open connections through it, NAT looks like a firewall. NIST SP 800-41 rejects that view: NAT should be considered a form of routing, not a type of firewall, and nobody should rely on NAT to provide the benefits of a firewall. According to NIST, a stateful firewall delivers the same benefit with less disruption to protocols.

RFC 4864 (May 2007) takes the same position: IPv4 NAT was not developed as a security mechanism, and translating address bits in the header does not provide security in itself. The perceived protection comes from the lack of pre-established mapping state, and a basic firewall offers the same. According to the RFC, NAT does provide topology hiding, but it also defeats the ability to produce an end-to-end audit trail at the network level. We cover the default-deny principle in our firewall article.

Side effects of NAT: VoIP, IPsec and NAT-T

According to RFC 3022, NAT takes away the end-to-end significance of an IP address, and protocols that carry addresses or ports inside their payload pay the price. According to RFC 3027 (January 2001), applications such as FTP, H.323, SIP and RTSP are usually broken by NAT devices along the path. ICE (RFC 8445, July 2018), the protocol the IETF defines for NAT traversal in UDP-based communication, relies on STUN and TURN.

According to RFC 3715 (March 2004), IPsec AH includes the source and destination addresses in its integrity check, so any address change breaks verification, while encrypted ESP traffic is opaque to the NAT. The fix is NAT traversal (NAT-T): ESP packets are encapsulated in UDP (RFC 3948, January 2005), using UDP port 4500. In IKEv1, NAT between the peers is detected as described in RFC 3947; according to RFC 7296, IKEv2 likewise UDP-encapsulates the packets of endpoints behind a NAT. That is why VPN gateways keep UDP port 4500 open; we explain the details in our VPN article.

NAT in IPv6 and NAT gateways in the cloud

IPv6 increases the IP address size from 32 bits to 128 bits (RFC 8200, July 2017), and according to RFC 4864, NAT's primary benefit of "amplifying" available address space is not needed in IPv6. Translation still has a role: NAT64 (RFC 6146, April 2011) lets IPv6-only clients reach IPv4 servers.

In the cloud, NAT is a managed service:

  • AWS: A NAT gateway lets instances in a private subnet connect to services outside the VPC, while external services cannot initiate connections to those instances. According to AWS, each IPv4 address supports up to 55,000 simultaneous connections to each unique destination.
  • Azure: NAT Gateway does not permit unsolicited inbound connections. As of March 31, 2026, new virtual networks default to private subnets, so reaching the internet takes an explicit outbound method. According to Microsoft, each public IP address provides 64,512 SNAT ports, and long idle timeouts increase the likelihood of SNAT port exhaustion.

We handle the design of this layer in our network & traffic engineering service and the rules side in our network security service.

Frequently asked questions

What does NAT stand for? Network Address Translation: changing a packet's IP address, and when needed its port, as it passes from one network to another.

What is PAT, and how is it different from NAT? PAT is the type of NAT that also translates port numbers: many devices share a single public IP address, and replies return to the right device based on the port number.

What is the difference between static and dynamic NAT? Static NAT permanently maps one internal address to one external address and is used for servers. Dynamic NAT gives internal hosts temporary addresses from a pool.

What is CGNAT? NAT that runs in an internet service provider's network and shares the same public IPv4 address among several subscribers.

Does NAT provide security? NAT is not a security control. Outside hosts being unable to open connections gives an impression of protection, but that protection should come from firewall rules.

Is there NAT in IPv6? IPv6's address space removes the need for NAT to share addresses. To let IPv6-only clients reach IPv4 servers, however, NAT64 is used.

Sources