Home/Learn/Computer Networks/NAT — Network Address Translation

NAT — Network Address Translation

Intermediate
Network Layer

NAT maps private IP addresses to one or more public IPs, allowing many devices behind a router to share a single public IP. It extends IPv4 address space but breaks end-to-end connectivity.

Overview

Network Address Translation (NAT) was invented as a stopgap for IPv4 exhaustion. Instead of every device needing a public IP, an entire LAN can share one. When a device sends a packet out, the NAT router replaces the private source IP with its own public IP and records the mapping (src IP, src port → public IP, mapped port) in a translation table. When the response arrives, it reverses the mapping and forwards the packet to the original sender. This is called NAPT or PAT (Port Address Translation) — the most common form. NAT is used everywhere: home routers, corporate networks, cloud NAT gateways, and Kubernetes. The trade-off is that NAT breaks the internet's original end-to-end connectivity model — a device behind NAT cannot be reached directly from the internet unless the NAT maintains an active outbound mapping, which is why peer-to-peer applications (WebRTC, torrents, VoIP) use techniques like STUN and TURN to traverse NAT.

How NAT Works — NAPT

NAPT (Network Address and Port Translation) is what your home router does. It tracks active connections in a translation table indexed by port number, allowing thousands of internal hosts to share one public IP.

NAPT translation table and packet flow
// NAPT translation table (inside a home router / AWS NAT Gateway):
// ┌────────────────────────┬─────────────────────────┬──────────────────────┐
// │ Private (src)          │ Public (translated src) │ Remote (dst)         │
// ├────────────────────────┼─────────────────────────┼──────────────────────┤
// │ 192.168.1.10:54231     │ 203.0.113.1:10001       │ 142.250.80.46:443    │
// │ 192.168.1.11:49812     │ 203.0.113.1:10002       │ 142.250.80.46:443    │
// │ 192.168.1.10:61002     │ 203.0.113.1:10003       │ 52.94.236.248:80     │
// └────────────────────────┴─────────────────────────┴──────────────────────┘

// Packet flow — outbound:
// Client 192.168.1.10:54231 → GET https://google.com (dst 142.250.80.46:443)
// NAT router rewrites:  src = 203.0.113.1:10001
// Google responds to:   203.0.113.1:10001
// NAT router looks up:  10001 → 192.168.1.10:54231
// NAT router rewrites:  dst = 192.168.1.10:54231 and forwards

// Types of NAT:
// Static NAT  — 1:1 mapping (one private IP → one public IP, always)
// Dynamic NAT — pool of public IPs, allocated as needed
// NAPT / PAT  — many private IPs share one public IP via port mapping (most common)
// Hairpin NAT — internal host reaches another internal host via public IP

NAT Traversal and Cloud NAT

NAT breaks incoming connections — a server behind NAT is unreachable from the internet unless port forwarding is configured. Peer-to-peer apps use STUN (discover public IP/port) and TURN (relay) to traverse NAT. Cloud NAT Gateways provide outbound internet for private subnets.

NAT traversal (STUN/TURN) and AWS NAT Gateway pattern
// NAT traversal techniques for P2P (WebRTC / VoIP):
//
// Problem: both peers are behind NAT, neither can accept incoming connections
//
// STUN (Session Traversal Utilities for NAT):
//   1. Client contacts STUN server on internet
//   2. STUN server reflects back client's public IP:port as seen from outside
//   3. Client shares this public IP:port with peer via signalling server
//   4. Both peers send to each other's public IP:port → NAT creates mapping
//
// TURN (Traversal Using Relays around NAT):
//   — Fallback when STUN fails (symmetric NAT)
//   — A relay server forwards packets between peers
//   — Used by ~15% of WebRTC connections

// AWS NAT Gateway — outbound internet for private subnets:
// Private subnet → NAT Gateway (in public subnet) → Internet Gateway → Internet
// NAT Gateway has an Elastic IP (fixed public IP)
// Instances in private subnet have no public IP but CAN reach internet
// Internet CANNOT initiate connections to private instances

// Spring Boot in private subnet — outbound HTTP still works:
// RestTemplate / WebClient calls work normally
// Incoming traffic must come through ALB in public subnet → private instances

Key Points to Remember

  • 1NAT replaces private source IPs with a public IP and tracks mappings by port.
  • 2NAPT/PAT allows thousands of devices to share one public IP — used in home routers and cloud.
  • 3NAT breaks end-to-end connectivity — external hosts cannot initiate connections to NATted devices.
  • 4STUN discovers the public IP:port a NATted client appears as; TURN relays traffic when STUN fails.
  • 5AWS NAT Gateway enables private subnet instances to access internet without being reachable from it.
  • 6IPv6 eliminates the need for NAT — every device gets a routable global address.

Interview Questions

Sign in to ask Aria
1

What is NAT and why was it invented?

EasyInfosys
2

How does NAPT allow multiple devices to share one public IP?

MediumAmazon
3

Why can't a server behind NAT be reached directly from the internet?

MediumFlipkart
4

What is the difference between STUN and TURN in NAT traversal?

HardGoogle
5

You have private EC2 instances that need to download packages from the internet. How would you set this up on AWS?

MediumAWS interview

Ask Aria about NAT — Network Address Translation

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Sign in to save personal notes for this topic.

Discussion

Sign in to join the discussion.

Loading discussion…