What Is NAT (Network Address Translation)?
Network Address Translation (NAT) is a method defined in RFC 3022 that remaps private IP addresses to public IP addresses, enabling multiple devices on a local network to share a single public IPv4 address for internet access. NAT operates at the network layer (Layer 3) of the OSI model and is implemented in routers, firewalls, and gateway devices that sit between a private network and the public internet.
NAT works by modifying the source or destination IP address in packet headers as traffic passes through the translating device. When an internal host sends a packet to the internet, the NAT device replaces the private source address (such as 192.168.1.10) with its own public address. It maintains a translation table that maps each active session so that return traffic can be correctly forwarded back to the originating internal host.
There are three primary types of NAT: Static NAT provides a permanent one-to-one mapping between a private address and a public address, commonly used for servers that must be reachable from the internet. Dynamic NAT assigns a public address from a pool on a first-come, first-served basis for each outbound session. Port Address Translation (PAT), also known as NAT overload or NAPT, is the most widely deployed form—it maps multiple private addresses to a single public address by differentiating sessions using unique source port numbers.
NAT Types Explained
Static NAT establishes a fixed one-to-one mapping between a single private IP address and a single public IP address. This mapping persists regardless of whether the host is actively communicating. Static NAT is primarily used for web servers, mail servers, and other resources that must maintain a consistent public address so external clients can initiate connections to them.
Dynamic NAT maintains a pool of public IP addresses and assigns one to an internal host when it initiates an outbound connection. Once the session ends and the translation entry times out, the public address is returned to the pool for reuse. Dynamic NAT is suitable for organizations that have fewer public addresses than internal hosts but do not require persistent address mappings.
Port Address Translation (PAT), also called NAPT (Network Address Port Translation) or NAT overload, is the dominant form of NAT in use today. PAT accounts for over 90% of consumer NAT deployments, including virtually every home router, mobile hotspot, and small business gateway. PAT maps thousands of concurrent sessions from internal hosts to a single public IP address by appending a unique source port number to each translation entry, supporting up to 65,535 simultaneous connections per public address.
Why NAT Exists: IPv4 Address Exhaustion
The Internet Assigned Numbers Authority (IANA) exhausted its pool of unallocated IPv4 addresses on February 3, 2011. NAT was introduced as a stopgap solution defined in RFC 1631 (1994) to extend the usable life of the IPv4 address space by allowing entire private networks to communicate through a single public address.
IPv4 provides approximately 4.3 billion unique addresses (2^32). When the internet's architects designed IPv4 in the early 1980s, this seemed more than sufficient. However, the explosive growth of personal computing, mobile devices, and IoT endpoints created demand that far exceeded the available supply. Without NAT, the IPv4 address space would have been exhausted years before IANA's final allocation.
Today, NAT remains essential infrastructure because the majority of internet-connected devices still rely on IPv4. Organizations that need public IPv4 addresses must purchase them on the secondary market, where prices have risen from under $10 per address in 2015 to over $30–$50 per address in 2026 depending on block size and region. This economic reality makes NAT not just a technical necessity but a financial one—reducing the number of public addresses an organization must acquire and maintain.
IPv4 to IPv6 Transition Mechanisms
The IPv4 to IPv6 transition is the process of migrating internet infrastructure from Internet Protocol version 4 (32-bit addresses) to Internet Protocol version 6 (128-bit addresses) to accommodate the growing number of internet-connected devices worldwide. As of 2026, approximately 45% of global internet traffic uses IPv6 while 55% remains on IPv4, indicating that full transition is still years—if not decades—away.
Dual-stack is the most widely recommended transition mechanism. In a dual-stack deployment, network devices, servers, and endpoints run both IPv4 and IPv6 simultaneously, choosing the appropriate protocol based on the destination address. Dual-stack provides full backward compatibility but requires managing two complete protocol stacks, including addressing, routing, DNS, security policies, and monitoring.
Tunneling mechanisms encapsulate IPv6 packets within IPv4 packets, allowing IPv6 traffic to traverse IPv4-only network segments. Common tunneling protocols include 6to4 (RFC 3056), which automatically creates tunnels using an IPv4 address embedded in a special IPv6 prefix; Teredo (RFC 4380), which tunnels IPv6 through IPv4 NAT devices using UDP encapsulation; and ISATAP (Intra-Site Automatic Tunnel Addressing Protocol), which connects IPv6 hosts within an IPv4 site network.
Translation mechanisms enable direct communication between IPv6-only and IPv4-only hosts without requiring both to support the same protocol. NAT64 (RFC 6146) translates IPv6 packets to IPv4 and vice versa at the network layer, while DNS64 (RFC 6147) synthesizes AAAA records from A records so that IPv6-only clients can reach IPv4-only servers. Together, NAT64/DNS64 allow organizations to deploy IPv6-only networks internally while maintaining access to the IPv4 internet—reducing operational complexity and eliminating the need for internal IPv4 address management.