Network Address Translation NAT Tutorial

Reaching the Internet requires a public IP address — one that’s globally unique. If every single host in the world needed its own unique public address, we’d have exhausted the entire IPv4 space years ago. Network Address Translation (NAT) is what lets us stretch that limited pool of addresses much further. The core idea, in one sentence:

NAT lets a host without a valid registered IP address communicate with other hosts over the Internet.

Say your computer has been assigned a private address, 10.0.0.9 — an address that can never be routed on the public Internet — yet you can still browse the web just fine. That’s because your router (or modem) translates that private address into a public one, say 123.12.23.1, before sending your traffic out onto the Internet.

Naturally, when a reply comes back addressed to 123.12.23.1, the router translates it right back to your private address, 10.0.0.9, before passing it along to you.

At this point you might reasonably ask: “What’s the actual benefit here? I still need one public address per host to get online — this doesn’t seem to save anything.” And you’d be right — the example so far doesn’t show NAT’s real value, but it does establish the basic mechanism. Here’s a second example that actually shows why NAT matters.

Say your company has 500 employees, but your ISP has only handed you 50 public IP addresses — meaning only 50 hosts could theoretically be online at once. This is exactly where NAT earns its keep.

In practice, not everyone’s online at the same moment — maybe 50 people check the news first thing in the morning, while a different 50 check email around noon. NAT can dynamically hand out those 50 public addresses to whoever actually needs one at that moment. This approach is called dynamic NAT.

Dynamic NAT alone doesn’t fully solve the problem, though — on a day when more than 50 people try to get online in the morning, only the first 50 succeed; everyone else has to wait their turn. And in reality, ISPs typically hand out even fewer public addresses than that, since every public IP has become a genuinely scarce resource.

To solve both of these problems at once, there’s another NAT feature: NAT Overload, more commonly known as Port Address Translation (PAT).

PAT maps many devices on a LAN to a single public IP address, telling them apart by port number instead. To keep every translation distinct, the router tracks a unique source port number for each one on that single inside global address. In the example below, every host shares the same public address, 123.1.1.1, distinguished only by different port numbers (1000 through 1002):

Note: Cisco calls the private address an inside local address, and the public address the router substitutes for it an inside global address.

NAT can also translate the address of the host on the outside. An outside global address is the public address used to route to that outside host across the Internet.

The last term, outside local address, is how a device on your local network refers to that external host — essentially, the “inside local” address of the external device, as seen from the other end of the connection.

How many ports can be used per public address? Since the port field is 16 bits wide, PAT can support roughly 2¹⁶ ports — well over 64,000 simultaneous connections from a single public IP address.

With the core mechanics covered, here’s a quick summary of NAT’s variants. There are two broad types of NAT translation — static and dynamic:

Static NAT: a fixed, one-to-one mapping between a local address and a global address. This requires a dedicated real Internet IP address for every single host that needs one.

Dynamic NAT: maps an unregistered address to a registered one, pulled from a pool of available registered addresses. Unlike static NAT, there’s no need to manually configure a fixed inside-to-outside mapping — but you still need enough real IP addresses to cover everyone who might need to reach the Internet at once. The inside local address list can be larger than the inside global address pool; the router hands out addresses from that pool until none are left, and simply drops any packet needing translation once the pool is exhausted.

PAT (NAT Overloading): a form of dynamic NAT that maps many private addresses to one public address (many-to-one), using port numbers to keep them distinct. Both static and dynamic NAT require a strict one-to-one mapping between inside local and inside global addresses — PAT breaks that constraint entirely, letting thousands of users share a single real public IP address. This is what has really kept the Internet from running out of public addresses, and it’s by far the most widely used form of NAT today.

NAT also has a side benefit worth mentioning: it lets you present just a single address to the outside world for your entire internal network, effectively hiding your internal addressing scheme from the public Internet — a modest but genuine security benefit.

NAT terms

• Inside local address — the real address of an internal host. This is typically not an address assigned by a registry or service provider; it’s usually a private, RFC 1918 address (for example, 192.168.1.1).
• Inside global address — how that internal host’s address appears to the outside world, after NAT translation.
• Outside local address — how an external host’s address appears from the inside network’s perspective.
• Outside global address — the external host’s real address (if that external host isn’t itself behind NAT, this is identical to its outside local address).

For a hands-on walkthrough of configuring NAT, see our separate Configure NAT GNS3 Lab tutorial.