What Is NAT? How It Works, Types & Troubleshooting

Network Address Translation, or NAT, changes address information as traffic crosses a network boundary. In the most familiar setup, a home or office router lets devices with private IPv4 addresses share one public IPv4 address.

NAT explains why a laptop can show 192.168.1.25 in its network settings while a website sees a completely different public address. The translation is useful, but it is not encryption, a VPN, a proxy service, or a complete security policy.

Quick Answer

NAT, or Network Address Translation, rewrites IP address information as packets pass through a router or gateway. Home networks commonly combine NAT with Port Address Translation so many private devices can share one public IPv4 address. The gateway keeps a translation table so replies return to the correct device. NAT does not encrypt traffic or guarantee anonymity.

Key Takeaways

• NAT translates addresses between network realms. The common home-router case translates private IPv4 traffic to a public IPv4 address.
• PAT lets many devices share one public address. It distinguishes concurrent flows with transport protocols and port numbers.
• A NAT table is temporary connection state. It links an internal address and port to an external mapping so return traffic reaches the right host.
• Private, shared, and public address space are different. 100.64.0.0/10 is carrier Shared Address Space, not one of the RFC 1918 private ranges.
• Port forwarding creates an inbound mapping. It must be paired with the correct firewall rule and cannot normally cross an upstream NAT that the subscriber does not control.
• Double NAT and CGNAT often cause inbound-connectivity problems. Browsing may work normally while hosting, gaming, peer-to-peer applications, or remote access fails.
• NAT is not a proxy, VPN, firewall, or anonymity system. These technologies can coexist, but each performs a different job.

Methodology: We reviewed the existing Proxidize article, the IETF descriptions of traditional NAT, private IPv4 addressing, IPv6 local-network protection, Shared Address Space, Port Control Protocol, and carrier-grade NAT requirements, plus current IANA address registries and Proxidize networking guides on September 29, 2026. The packet examples below use reserved documentation addresses; they are explanatory, not a live network test.

What Is NAT?

Network Address Translation is a function that maps an IP address in one network realm to an address in another. The gateway rewrites relevant packet headers and keeps enough state or configuration to reverse the translation for returning traffic.

RFC 3022 describes two traditional forms:

• Basic NAT maps IP addresses.
• Network Address Port Translation, or NAPT, maps addresses and transport identifiers such as TCP or UDP ports.

Most consumer routers use the second form. It is commonly called NAT, PAT, NAPT, NAT overload, or masquerading depending on the vendor and operating system.

The three devices retain separate private addresses on the local network. Internet destinations normally see connections from the router's public address. Port mappings and protocol state let the router distinguish their return traffic.

This is the typical IPv4 use case, not the only possible translation design. NAT can map between two IPv4 realms, translate destinations for inbound services, or participate in IPv4/IPv6 transition systems. This guide focuses on the NAT44 behavior most people encounter at home, in small offices, and behind internet providers.

How Does NAT Work?

Consider a laptop opening an HTTPS connection. The following values are examples only; 192.0.2.0/24 and 198.51.100.0/24 are reserved for documentation.

The connection follows this sequence:

1. The laptop sends a TCP packet from 192.168.1.25:51514 to 192.0.2.80:443.
2. The router receives the packet on its internal interface.
3. The router creates or reuses a NAT mapping.
4. It replaces the private source address with 198.51.100.20 and, in this example, replaces source port 51514 with 62001.
5. It updates the affected checksums and sends the packet toward the website.
6. The website replies to 198.51.100.20:62001.
7. The router finds the mapping, restores destination 192.168.1.25:51514, and forwards the packet to the laptop.

The translation can be summarized as follows:

The remote server does not send a reply directly to 192.168.1.25; that private address is not globally reachable. It replies to the public address and mapped port exposed by the NAT device.

What Is a NAT Table?

A NAT table records active or configured mappings. Exact fields differ by implementation, but an entry can include:

Dynamic entries are not permanent. A router may remove them when a TCP flow closes or after a protocol- and implementation-specific idle period. UDP has no TCP-style connection teardown, so a NAT usually relies more heavily on timers.

This state explains several practical behaviors:

• Unsolicited inbound traffic usually has no matching dynamic entry and is not delivered to an internal device.
• A long-idle application can lose its mapping and need to reconnect or send a keepalive.
• Rebooting the router clears dynamic state and interrupts active connections.
• Asymmetric routing can fail when the reply bypasses the NAT that created the mapping.
• A busy gateway can run out of mapping, port, memory, or processing capacity even when bandwidth remains available.

The NAT table should not be confused with a routing table. A routing table chooses the next network path; a NAT table records how address and port values are translated.

What Does NAT Change?

Traditional NAT changes selected network and transport-header information. It does not automatically change every property of a connection.

HTTPS, SSH, and VPN protocols can encrypt traffic carried through NAT. Their encryption comes from those protocols, not from the address translation.

Public, Private, and Shared IP Addresses

The address on a local device and the address observed by a website often differ because they belong to separate address realms.

IANA lists three private-use IPv4 blocks, as originally defined by RFC 1918:

Private addresses can be reused independently by many organizations. A router translates them when traffic needs to cross into a realm where those addresses are not valid.

Carrier networks also use 100.64.0.0/10. RFC 6598 reserves this as Shared Address Space for service-provider NAT deployments. It is not an RFC 1918 private range, even though it is also not globally reachable.

Do not assume every address outside the three private ranges is an ordinary public address. IANA maintains an IPv4 Special-Purpose Address Registry covering loopback, link-local, documentation, benchmarking, shared, and other special blocks.

For a deeper explanation of local and Internet-facing addresses, see public vs. private IP addresses.

Static NAT vs. Dynamic NAT vs. PAT

Static, dynamic, and port-based translation describe different mapping strategies.

Static NAT

Static NAT keeps a consistent mapping, such as one private server address to one public address. It can make address translation predictable, but it does not automatically permit traffic. Firewall policy remains separate.

Static NAT also does not mean the ISP has assigned a permanent public address. The external address must still be provided and routed by the upstream network.

Dynamic NAT

Dynamic NAT selects an available address from a configured pool. The same internal host may receive a different public mapping later. Unlike PAT, each active basic-NAT mapping typically consumes one address from the pool.

PAT or NAPT

Port Address Translation lets simultaneous connections share a public address. The combination of public IP, translated port, and protocol helps keep flows distinct. This is the behavior most people mean when they say their home router “does NAT.”

NAT vs. PAT: What Is the Difference?

NAT is the broader concept of translating network addresses. PAT is a many-to-one technique that also translates transport ports.

Strictly speaking, the common home-router setup is NAPT. In everyday product interfaces, documentation, and support conversations, it is usually shortened to NAT. When troubleshooting, ask whether the device translates only addresses or also ports rather than relying on the label alone.

SNAT, DNAT, and Port Forwarding

Source and destination NAT describe which side of the packet is rewritten.

• Source NAT, or SNAT, changes the source address. Outbound private-to-public translation is the familiar example.
• Destination NAT, or DNAT, changes the destination address. Publishing an internal service through an external address is a common example.
• Port forwarding creates a mapping from an external address, protocol, and port to an internal address and port. It is commonly implemented with destination translation plus an appropriate firewall rule.

A port-forwarding rule might look like this:

Someone connecting to public port 8443 is forwarded to the internal service on port 443. These are documentation addresses, not a functioning endpoint.

Before exposing a service, confirm all of the following:

1. The service is listening on the expected internal address and port.
2. The internal device has a stable address, usually through a DHCP reservation or deliberate static configuration.
3. The forwarding rule uses the correct TCP or UDP protocol.
4. Router and host firewalls permit only the required traffic.
5. The router has a usable public address rather than an uncontrolled upstream NAT.
6. The application is patched, authenticated, and designed for Internet exposure.
7. The test is performed from outside the local network unless hairpin NAT support has been confirmed.

Port Control Protocol is one standards-based way for a host to request mappings from a participating NAT or firewall. Consumer equipment may instead expose manual rules or other automatic mapping systems. Automatic convenience should not replace review of which service is being exposed.

What Is Double NAT?

Double NAT occurs when traffic crosses two IPv4 translation layers before reaching the Internet.

Common causes include:

• connecting a personal router behind an ISP modem/router that is still routing;
• placing a second Wi-Fi router behind the first;
• running a nested lab or virtual network;
• receiving a non-public WAN address from the ISP;
• using an upstream network that performs NAT before the subscriber's router.

Ordinary outbound browsing often works. Problems appear with inbound connections, port forwarding, peer-to-peer applications, some VPN protocols, voice or video sessions, remote access, and gaming.

Possible fixes depend on who controls the two devices:

• put the ISP gateway into bridge or passthrough mode where supported;
• use the second device as an access point instead of another router;
• forward through both layers, although this increases complexity;
• request a public address from the ISP;
• use an authorized outbound tunnel or relay when direct inbound addressing is unavailable.

Do not enable bridge mode without understanding which device will provide firewalling, authentication, Wi-Fi, and DHCP afterward.

What Is CGNAT?

Carrier-Grade NAT is translation performed inside an Internet service provider's network. It allows multiple subscribers to share a smaller supply of public IPv4 addresses.

RFC 6888 documents common requirements for carrier-grade NATs. It also addresses explicit subscriber control of mappings, but real provider support and product terms vary. Do not assume a home-router port-forwarding rule can configure the carrier's gateway.

CGNAT is common in mobile and fixed networks, but implementation varies. It is inaccurate to say every mobile subscriber is always behind the same NAT arrangement or that a public address changes on one universal schedule.

The complete CGNAT guide covers the 100.64.0.0/10 range, verification, gaming, hosting, VPNs, IPv6, and available workarounds in more detail.

How to Check Whether You Are Behind NAT, Double NAT, or CGNAT

Compare three different addresses instead of relying on one checker.

1. Find the Device's Local Address

Open the active network connection's details on the computer, phone, or console. An address in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 confirms that the device is using private IPv4 locally. That is normal and does not reveal how many upstream translation layers exist.

2. Find the Router's WAN or Internet IPv4 Address

Sign in to the router or gateway you administer and locate its WAN, Internet, or uplink IPv4 address. Do not publish a full production address in screenshots or support forums.

3. Check the Public IP From the Same Route

Open the Proxidize IP Checker or another trusted public-IP service from the application being tested. Disable an application proxy or VPN only when it is safe and appropriate to test the ordinary ISP path; otherwise, the checker may correctly show that intermediary's exit instead.

4. Compare the Results

The WAN comparison is evidence, not universal proof. Router interfaces can display stale data; VPNs, proxies, failover links, IPv6, or provider-specific designs can change the observed path. The ISP is the authoritative source for whether the subscription uses CGNAT.

What Do Open, Moderate, and Strict NAT Types Mean?

Gaming platforms and applications sometimes label connectivity as Open, Moderate, Strict, Type 1, Type 2, Type 3, or another product-specific category. These are reachability summaries, not Internet-standard NAT architectures.

The labels can reflect:

• whether unsolicited inbound traffic can reach the application;
• whether a stable port mapping can be created;
• how the NAT maps and filters traffic for different remote endpoints;
• whether UPnP, PCP, manual forwarding, or a relay is available;
• whether another NAT or CGNAT exists upstream;
• the application's own test method and servers.

An “Open” result does not necessarily mean NAT is disabled or that every inbound port is exposed. A “Strict” result does not diagnose the exact cause. Use the platform's current support instructions and change only the mappings needed by the application.

If gaming or voice chat fails:

1. Confirm the console or computer has a stable local address.
2. Check for a second router and compare the router WAN address with the public IP.
3. Update router firmware and review firewall rules.
4. Use the application's documented ports or supported automatic mapping method.
5. Avoid placing a device in a fully exposed DMZ merely to improve a label unless the security consequences are understood.
6. Ask the ISP about CGNAT or public-address options when the outer layer cannot be controlled.

Latency and NAT type are separate. A strict reachability result can disrupt peer connectivity without being the cause of general network latency.

Is NAT a Firewall?

No. NAT translates addresses; a firewall permits or denies traffic according to security policy. Home gateways frequently implement both, which is why the functions are easy to confuse.

RFC 4864 explicitly notes that IPv4 NAT was not developed as a security mechanism. The common protection effect comes from stateful behavior: unsolicited inbound traffic lacks an existing mapping and is not delivered. A stateful firewall can provide that filtering without translating addresses.

The difference becomes obvious with static mappings and port forwarding. NAT can translate an inbound connection to an internal host, while a firewall independently decides whether that connection is allowed.

Use explicit firewall policy, secure host configuration, updates, and application authentication. Do not treat private addresses or NAT alone as complete protection.

NAT vs. Proxy vs. VPN

NAT, forward proxies, and VPNs can all cause a destination to observe an address different from a device's local address. Their mechanisms and control scopes are different.

A home router's NAT usually changes the source address of all matching outbound traffic without the browser selecting it. A forward proxy is explicitly configured or enforced and can offer provider-controlled locations, sessions, and exit pools. A VPN establishes an encrypted tunnel and can cover traffic according to its routes.

The tools can be combined. A device can sit behind home NAT, connect through a VPN, and then use an application proxy. More layers are not automatically safer or better; they add routing, DNS, performance, and troubleshooting dependencies.

See VPN vs. proxy for the fuller traffic-coverage and encryption comparison.

Does NAT Hide Your IP Address?

NAT replaces a private source address with a public mapping for traffic that crosses the gateway. The destination normally sees the public NAT address rather than 192.168.x.x or another internal address.

That is address translation, not anonymity. A destination can still associate activity with:

• the shared public IP;
• an account or login;
• cookies and local storage;
• request and browser characteristics;
• application identifiers;
• timing and behavior;
• information voluntarily submitted to the service.

Several people or devices sharing one public address also does not make their activity indistinguishable. NAT changes the network-layer route, while applications operate with much more context.

What Does NAT Mode Mean for a Virtual Machine?

In a virtual-machine NAT mode, the guest receives an address on a virtual private network and reaches external networks through translation performed by the virtualization platform or host-side networking service.

The VM can therefore show a different private address while websites still see the same public ISP address as the host. Changing a VM from NAT to bridged mode changes how it joins the local network; it does not automatically provide another public address or country.

The virtual-machine networking guide explains NAT, bridged, and host-only modes and shows why a proxy configured inside one guest application has a different scope from the VM's network adapter.

Does IPv6 Need NAT?

IPv6 was designed with a much larger address space, so private-to-public translation is not normally required for address conservation. Devices can receive globally unique IPv6 addresses while a stateful firewall controls unsolicited inbound access.

This does not mean every IPv6 device should be reachable from everywhere. Routing and firewall policy still matter. Privacy addresses can also reduce long-term address stability without translating the address at a gateway.

Translation still exists in IPv6 environments for specific purposes. NAT64, for example, helps IPv6 clients communicate with IPv4 services. That is a protocol-transition function, not evidence that ordinary NAT44 is required for native IPv6 security.

NAT and firewalls should remain separate concepts: address translation is not what makes an IPv6 network safe.

Benefits and Limitations of NAT

NAT solved practical IPv4 deployment problems, but its tradeoffs should be stated precisely.

Applications that embed IP addresses or ports in their payloads can require NAT-aware designs, application-level gateways, or traversal protocols. Peer-to-peer systems commonly use techniques such as STUN, ICE, or relays because not every NAT permits the same mappings.

NAT can also complicate attribution. One public IP may represent many devices or subscribers, so an address alone does not identify one user. Operators that need auditability must retain appropriately protected and time-synchronized mapping records under applicable privacy and retention rules.

Common NAT Problems and How to Troubleshoot Them

Avoid changing several layers at once. Record the device IP, router WAN address, public IP, timestamp, protocol, ports, and exact failure before changing the configuration. That makes it possible to distinguish NAT from DNS, firewall, application, or provider problems.

Where NAT Fits With Proxidize

NAT explains the underlying route, while a managed proxy gives an application deliberate control over the exit network, location, and session behavior.

For example, a mobile carrier may use CGNAT internally. That carrier behavior is not the same as a proxy provider's rotating or sticky session policy. Carrier reassignment and NAT mappings happen in the access network; the Proxidize access point is the application-facing proxy configuration.

Proxidize Mobile Proxies provide real US mobile-network routes with supported city and carrier targeting. Proxidize Residential Proxies provide residential routes across 195+ countries with country, city, and ISP targeting. Both product families expose standard proxy connection details and supported rotating or sticky behavior.

For a configured request, the route can include several distinct address layers:

The destination normally sees the proxy exit, not the application's private address or ordinary direct public route. Traffic that is not configured to use the proxy continues according to the device's other routes.

Use the Proxidize IP Checker inside the configured browser or application to confirm which public address that request exposes. A successful check proves the route used by that request; it does not establish that every application on the device is proxied.

What Should You Remember About NAT?

NAT maps addresses between network realms. In the familiar home-router design, PAT lets many private IPv4 devices share one public address, while a translation table directs return traffic to the correct internal flow.

That simple model explains public-versus-private address differences, but practical troubleshooting requires checking every layer. Port forwarding needs an inbound mapping and firewall permission. Double NAT adds another gateway. CGNAT adds a provider-controlled layer that a home-router rule usually cannot change.

Most importantly, translation is not encryption, anonymity, or a security policy. Treat NAT, firewalls, proxies, and VPNs as separate tools, then verify the exact route the application is using.