NAT — Network Address Translation
IntermediateNAT maps private IP addresses to one or more public IPs, allowing many devices behind a router to share a single public IP. It extends IPv4 address space but breaks end-to-end connectivity.
Overview
Network Address Translation (NAT) was invented as a stopgap for IPv4 exhaustion. Instead of every device needing a public IP, an entire LAN can share one. When a device sends a packet out, the NAT router replaces the private source IP with its own public IP and records the mapping (src IP, src port → public IP, mapped port) in a translation table. When the response arrives, it reverses the mapping and forwards the packet to the original sender. This is called NAPT or PAT (Port Address Translation) — the most common form. NAT is used everywhere: home routers, corporate networks, cloud NAT gateways, and Kubernetes. The trade-off is that NAT breaks the internet's original end-to-end connectivity model — a device behind NAT cannot be reached directly from the internet unless the NAT maintains an active outbound mapping, which is why peer-to-peer applications (WebRTC, torrents, VoIP) use techniques like STUN and TURN to traverse NAT.
How NAT Works — NAPT
NAPT (Network Address and Port Translation) is what your home router does. It tracks active connections in a translation table indexed by port number, allowing thousands of internal hosts to share one public IP.
// NAPT translation table (inside a home router / AWS NAT Gateway):
// ┌────────────────────────┬─────────────────────────┬──────────────────────┐
// │ Private (src) │ Public (translated src) │ Remote (dst) │
// ├────────────────────────┼─────────────────────────┼──────────────────────┤
// │ 192.168.1.10:54231 │ 203.0.113.1:10001 │ 142.250.80.46:443 │
// │ 192.168.1.11:49812 │ 203.0.113.1:10002 │ 142.250.80.46:443 │
// │ 192.168.1.10:61002 │ 203.0.113.1:10003 │ 52.94.236.248:80 │
// └────────────────────────┴─────────────────────────┴──────────────────────┘
// Packet flow — outbound:
// Client 192.168.1.10:54231 → GET https://google.com (dst 142.250.80.46:443)
// NAT router rewrites: src = 203.0.113.1:10001
// Google responds to: 203.0.113.1:10001
// NAT router looks up: 10001 → 192.168.1.10:54231
// NAT router rewrites: dst = 192.168.1.10:54231 and forwards
// Types of NAT:
// Static NAT — 1:1 mapping (one private IP → one public IP, always)
// Dynamic NAT — pool of public IPs, allocated as needed
// NAPT / PAT — many private IPs share one public IP via port mapping (most common)
// Hairpin NAT — internal host reaches another internal host via public IPNAT Traversal and Cloud NAT
NAT breaks incoming connections — a server behind NAT is unreachable from the internet unless port forwarding is configured. Peer-to-peer apps use STUN (discover public IP/port) and TURN (relay) to traverse NAT. Cloud NAT Gateways provide outbound internet for private subnets.
// NAT traversal techniques for P2P (WebRTC / VoIP):
//
// Problem: both peers are behind NAT, neither can accept incoming connections
//
// STUN (Session Traversal Utilities for NAT):
// 1. Client contacts STUN server on internet
// 2. STUN server reflects back client's public IP:port as seen from outside
// 3. Client shares this public IP:port with peer via signalling server
// 4. Both peers send to each other's public IP:port → NAT creates mapping
//
// TURN (Traversal Using Relays around NAT):
// — Fallback when STUN fails (symmetric NAT)
// — A relay server forwards packets between peers
// — Used by ~15% of WebRTC connections
// AWS NAT Gateway — outbound internet for private subnets:
// Private subnet → NAT Gateway (in public subnet) → Internet Gateway → Internet
// NAT Gateway has an Elastic IP (fixed public IP)
// Instances in private subnet have no public IP but CAN reach internet
// Internet CANNOT initiate connections to private instances
// Spring Boot in private subnet — outbound HTTP still works:
// RestTemplate / WebClient calls work normally
// Incoming traffic must come through ALB in public subnet → private instancesKey Points to Remember
- 1NAT replaces private source IPs with a public IP and tracks mappings by port.
- 2NAPT/PAT allows thousands of devices to share one public IP — used in home routers and cloud.
- 3NAT breaks end-to-end connectivity — external hosts cannot initiate connections to NATted devices.
- 4STUN discovers the public IP:port a NATted client appears as; TURN relays traffic when STUN fails.
- 5AWS NAT Gateway enables private subnet instances to access internet without being reachable from it.
- 6IPv6 eliminates the need for NAT — every device gets a routable global address.
Interview Questions
Sign in to ask AriaWhat is NAT and why was it invented?
How does NAPT allow multiple devices to share one public IP?
Why can't a server behind NAT be reached directly from the internet?
What is the difference between STUN and TURN in NAT traversal?
You have private EC2 instances that need to download packages from the internet. How would you set this up on AWS?
Ask Aria about NAT — Network Address Translation
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.