Progress pill
IPv4 addressing

NAT: Address Translation

IP networks - From Theory to Practice

NAT: Address Translation

  • Definition
  • Translation types
  • NAT implementation

Definition

Network Address Translation_ (NAT) is a technique developed to address the gradual depletion of available IPv4 addresses. Designed as an interim solution before the widespread adoption of IPv6, NAT enabled companies and individuals to keep connecting large numbers of machines while using only a limited set of public IP addresses.
Important reminder: the move from IPv4 to IPv6 theoretically solves the exhaustion problem by expanding the address space from 32 bits to 128 bits, providing an almost unlimited number of addresses (2^128). In practice, however, the transition is still incomplete, and NAT remains widely used today.
The principle behind NAT is simple but highly effective: instead of assigning a unique public IP address to every device on the internal network, a single routable address (or a small pool of addresses) is used for all private devices. The NAT gateway, often integrated into the router or firewall, then dynamically translates the internal IP address along with the information needed to route traffic correctly to the outside world, and ensures that responses are returned to the original sender.
This approach has an immediate benefit: it completely hides the internal network architecture. To an outside observer, all requests from workstations, servers or printers appear to come from the same public identity. Private addresses, usually taken from reserved ranges (e.g. 192.168.x.x or 10.x.x.x), remain invisible from the Internet.
In addition to addressing IPv4 scarcity, NAT also strengthens security by creating a first logical barrier between the internal and public networks. Unsolicited inbound communications are naturally blocked, since only connections initiated from inside the network benefit the necessary translation to receive responses.

Translation types

NAT can be implemented in different ways to suit specific needs. The two main modes of operation are static translation and dynamic translation.
Static translation creates a fixed mapping between a private IP address and a public IP address. Each internal machine is permanently linked to its dedicated public address. For example, an internal device configured as 192.168.20.1 could be associated with the routable address 157.54.130.1. When an outgoing packet leaves the local network, the router replaces the packet's source address with the public address, and performs the reverse operation for incoming traffic. This bidirectional translation is transparent to the user.
Warning: While this method isolates the internal network, it doesn't solve the shortage of public IP addresses, since you still need as many public addresses as there are machines to expose. Static translation is therefore mainly used when certain internal resources must remain reachable from the outside (web server, mail server...).
Dynamic translation, on the other hand, uses a pool of public IP addresses. When an internal host starts a connection, the router temporarily assigns one of these public addresses to the host's private address for the duration of the session. The link is 1-to-1, but temporary:once the connection ends, the public address becomes available for another device. Dynamic NAT therefore reduces the number of public addresses needed when not all machines are online at the same time, but it still requires a block of external addresses at least as large as the maximum number of simultaneous connections.
Port translation (PAT), also known as NAT overload or IP masquerading, goes a step further: all private devices share a single public IP address (or a very small number). To distinguish sessions, the gateway modifies not only the source address, but also the source port. It keeps a table linking each (private address, private port) pair to a unique (public address, public port) pair. This form of NAT is used in almost all home routers, allowing dozens of devices (computers, smartphones, connected objects, etc.) to share the same public IP address, while maintaining fluid communication.
NAT therefore extends IPv4's lifespan, while adding a valuable layer of segmentation and security. However, as IPv6 adoption grows and its vast address space become more widely used, the role of NAT will likely decline, though for compatibility and control purposes, it will still be used in some environments to segment and filter traffic.

NAT implementation

To ensure the proper operation of address translation, the NAT router or gateway must keep an accurate record of the mappings established between each private address on the internal network and the public address it uses to communicate with the outside world. This information is stored in what's known as the "NAT translation table", which plays a central role in managing network traffic.
Each entry in this table links at least one pair: the internal IP address of the sending machine and the external IP address that will be exposed on the Internet. When a packet from the private network is sent to a public destination, the NAT router intercepts the frame, analyzes the IP and TCP/UDP headers, then replaces the private source address with the gateway's public address. On the return path, the same gateway captures the incoming packet, checks the mapping table and performs the reverse operation to redirect the flow to the original internal IP address.
This dynamic translation principle relies on precise table management: each entry remains valid as long as there is active traffic to justify it. After a configurable period of inactivity, the entry is cleared and can be reused for new connections.
Example of a simplified NAT translation table:
Internal IPExternal IPDuration (sec)Reusable?
10.101.10.20193.48.100.1741,200no
10.100.54.251193.48.101.83,601yes
10.100.0.89193.48.100.460no
In this example, if no packet has passed through for the second entry in over an hour (3,600 seconds), it is marked as reusable. Conversely, a duration of zero indicates an active communication, with the mapping locked.
While NAT operates transparently for most common uses (web browsing, e-mail, file transfer, etc.), it can create additional challenges for certain network applications. Some technologies rely on explicitly exchanging IP addresses or ports within the packet payload. After passing through a NAT gateway, this information becomes inconsistent.
Typical examples of limitations include:
  • Peer-to-peer protocols (P2P), which require direct connections between devices, are hindered by the NAT barrier, since all internal machine shares the same external IP address and cannot be reached directly without specific configuration (such as port forwarding or UPnP);
  • The IPSec protocol, used to secure network communications, encrypts packet headers. Because NAT must modify these headers to replace IP addresses, encryption makes this impossible without adaptation mechanisms such as NAT-T (NAT Traversal);
  • The X Window protocol, which allows remote display of graphical applications on Unix/Linux, works in a way that the X server actively sends TCP connections to clients. This reversal of the usual direction of connections can be blocked by NAT.
In general, any protocol that explicitly includes the internal IP address in the packet payload will be affected, since that address will no longer match the real, internet-visible address after translation.
Important note: To address these issues, some NAT routers offer Deep Packet Inspection (DPI) or Protocol Helpers , which inspect packet contents to identify and dynamically replace addresses or port numbers within application data. This requires in-depth knowledge of the protocol format, and can create security vulnerabilities or increase resource usage.
Caution: Although NAT helps hide the internal network and control incoming traffic, it is not a substitute for a dedicated firewall. Translation alone is not a complete security barrier: it must always be complemented by clear filtering rules to block unsolicited or unwanted traffic.
To illustrate how this works in practice, consider the following example:
In this scenario, an internal workstation can access the internal web server simply by calling the URL http://192.168.1.20:80. Specifying the port is optional here, since 80 is the standard HTTP port.Conversely, if a request is initiated from the outside, the user will enter the public address http://85.152.44.14:80. The NAT router receives the request, consults its mapping table, and automatically translates the public address into a private one, redirecting the connection to http://192.168.1.20:80.
The same principle applies to any other server authorized to receive internet connections, such as the Extranet server (blue circuit in the diagram).
Practical note: in virtualized environments, network interfaces called virbrX (for Virtual Bridge X) are commonly used. These virtual bridges, provided in particular by the libvirt library or the Xen hypervisor, connect the virtual internal network of guest machines to the physical network while applying NAT. They are generally configured via scripts in /etc/sysconfig/network-scripts/, as shown below for virbr0:
NAME=""
BOOTPROTO=none
MACADDR=""
TYPE=Bridge
DEVICE=virbr0
NETMASK=255.255.255.0
MTU=""
BROADCAST=192.168.0.255
IPADDR=192.168.0.1
NETWORK=192.168.0.0
ONBOOT=yes
Once the virtual bridge is in place, you need to enable IP routing and configure port translation with iptables:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o <WAN> -s 192.168.0.0/24 -j MASQUERADE
With this configuration, outgoing traffic is routed and NAT translation is applied, allowing virtual machines to communicate with the outside world without directly exposing their internal IP addresses.
In the next chapter, we'll look in detail at IP address configuration under Linux, covering both simple and advanced methods suited to different administration contexts.
pi-hole
Pi-HoleAn ad blocker for your entire network
opnsense
OPNsenseHow do I install and configure an OPNsense firewall?
pfsense
pfSenseInstalling Pfsense
Quiz
Quiz1/5
Which NAT mode allows dozens devices to share a single public IP address by modifying ports?