What is NAT? Static, Dynamic and PAT Explained with Configuration

NAT (Network Address Translation) rewrites the IP addresses in a packet header as it crosses a router, so hosts using private addresses can communicate with the public internet. Your home router does this for every device you own, which is why fifty devices behind it all appear to the internet as a single address.

NAT exists because IPv4 has only about 4.3 billion addresses and the internet needed more. It was designed as a stopgap in the mid-1990s and became permanent infrastructure.

How NAT Works

1. A laptop at 192.168.1.50 opens a connection to 142.250.185.78:443 using source port 51000.
2. The packet reaches the router. The source address 192.168.1.50 is private and cannot be routed on the internet.
3. The router rewrites the source to its own public address, say 203.0.113.10, and records the mapping in its translation table.
4. The reply comes back addressed to 203.0.113.10:51000.
5. The router looks up the translation table, rewrites the destination back to 192.168.1.50:51000, and forwards it to the laptop.

The translation table is the whole mechanism. Without an existing entry, the router has no idea which internal host an inbound packet belongs to, which is why unsolicited inbound connections do not work through NAT without explicit configuration.

Inside and Outside Terminology

The trick to remembering these: inside/outside says which network the host belongs to; local/global says from whose point of view the address is being described.

The Three Types of NAT

Static NAT

A fixed one-to-one mapping. Used when an internal server needs a consistent public address that outside hosts can initiate connections to.

Router(config)# ip nat inside source static 192.168.1.10 203.0.113.20

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip nat inside
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip nat outside

Dynamic NAT

Internal hosts draw a public address from a pool when they need one, and release it afterwards. If the pool empties, further hosts simply cannot get out. This is mostly historical, it consumes public addresses without the compensating benefit of static NAT.

Router(config)# ip nat pool PUBLIC-POOL 203.0.113.20 203.0.113.30 netmask 255.255.255.0
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool PUBLIC-POOL

PAT, Port Address Translation

Also called NAT overload, and the one you actually use. Many internal hosts share one public address, distinguished by source port number. In theory this allows around 64,000 concurrent sessions per public address.

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

The overload keyword is what turns dynamic NAT into PAT. interface rather than a pool means “use whatever address the WAN interface has”, which is what you want on a DHCP or PPPoE circuit.

Port Forwarding

Because PAT has no mapping for an unsolicited inbound packet, hosting anything behind NAT requires a manual entry, a static PAT mapping, called port forwarding on consumer routers:

Router(config)# ip nat inside source static tcp 192.168.1.10 80 interface Gi0/1 80
Router(config)# ip nat inside source static tcp 192.168.1.10 443 interface Gi0/1 443

This is what you configure to reach a home game server, a security camera NVR, or a self-hosted service from outside.

Verifying NAT

Router# show ip nat translations
Router# show ip nat statistics
Router# debug ip nat
Router# clear ip nat translation *

show ip nat translations is the first thing to check when NAT “is not working”, if there is no entry, the traffic never matched your ACL or the interfaces are not marked inside and outside.

What NAT Costs You

NAT solved address exhaustion by breaking the internet’s end-to-end model, and that has consequences:

• No inbound connections. Peer-to-peer applications, VoIP and gaming need workarounds, STUN, TURN, ICE, UPnP or manual port forwarding.
• Protocols that embed IP addresses break. FTP in active mode, SIP and H.323 put addresses inside the payload, which NAT does not rewrite. Routers need application-layer gateways (ALGs) to fix this, and those ALGs frequently cause their own bugs.
• IPsec AH fails entirely. AH authenticates the IP header, and NAT changes the IP header. NAT-Traversal (encapsulating ESP in UDP 4500) exists to work around it.
• Logging and attribution get harder. Hundreds of subscribers behind carrier-grade NAT share one address, so an abuse report identifies a whole pool rather than a user.
• Extra state and latency. The router must track every session, and the table is finite.

Is NAT a Security Feature?

Not really, this is a persistent misconception worth being precise about.

NAT does have a side effect that resembles security: because there is no translation entry for unsolicited inbound traffic, that traffic is dropped. Internal hosts are effectively unreachable from outside by default.

But that is a consequence of the address shortage workaround, not a security policy. NAT does not inspect traffic, does not filter outbound connections, does not stop malware from calling home, and does not protect against anything that arrives over a connection an internal host opened, which is how essentially all modern compromise happens. A stateful firewall is the security control; NAT just happens to sit next to one in the same box.

NAT and IPv6

IPv6 has enough addresses that NAT is unnecessary, every device can hold a globally routable address. NAT66 exists but is discouraged. What IPv6 does need is a stateful firewall, precisely because the accidental inbound-blocking side effect of NAT is gone. NAT64 and DNS64 are used during transition so IPv6-only clients can reach IPv4-only servers.

Frequently Asked Questions

What is the difference between NAT and PAT?

PAT is a form of NAT. NAT translates addresses; PAT translates addresses and ports so many hosts can share a single public address. When people say “NAT” about a home router, they almost always mean PAT.

Does NAT slow down my connection?

Negligibly on modern hardware, translation is done in the forwarding path. What can hurt is the translation table filling up under heavy peer-to-peer or scanning load, at which point new connections fail.

How many devices can share one public IP with PAT?

Theoretically about 64,000 concurrent sessions per public address, but each device holds many sessions at once, so the practical figure is a few hundred to a few thousand devices depending on usage.

Why can’t I host a server behind NAT?

Because inbound packets have no translation entry to match. Configure port forwarding (static PAT) for the specific port, or use a service that establishes an outbound tunnel instead.

What is carrier-grade NAT?

CGNAT is NAT run by the ISP, so your router receives a private address rather than a public one and is itself behind another layer of translation. It saves the ISP public addresses but breaks port forwarding entirely, you cannot open a port on an address you do not control.

What is a NAT type in gaming consoles?

Consoles report NAT Type 1 (open, no NAT), Type 2 (moderate, NAT with working UPnP or port forwarding) and Type 3 (strict, restrictive NAT). Type 3 causes matchmaking and voice chat problems, and is usually fixed by enabling UPnP or forwarding the game’s ports.