NAT
Network address translation, the technique that lets many devices share one public IP address by rewriting traffic as it passes through a router.
NAT is the workaround that bought IPv4 an extra few decades. The internet's addressing was designed for one address per machine, and there have not been enough addresses for that since the 1990s, so the answer was to stop giving every machine a public one. Devices inside a network use private addresses, and a router rewrites their traffic to share the single public address it holds.
The mechanism is bookkeeping rather than magic. When a device inside sends a request, the router swaps the private source address and port for its own public address and a port it chooses, and writes that mapping into a translation table. When the reply arrives at that port, the table says which inside device the conversation belongs to, and the router rewrites it back. Thousands of simultaneous conversations from dozens of devices ride one address this way, distinguished only by port numbers.
Two consequences follow, and both matter well beyond home networking. The first is that a public IP address stopped identifying a device and started identifying a boundary: everything in the house, flat or office behind that router presents the same address, which is why an address is evidence about a connection point and not about a person. The second is that unsolicited inbound traffic has nowhere to go. A connection nobody inside initiated matches nothing in the table, so it is dropped, which is why NAT acts as an accidental firewall and why anything that must be reachable from outside needs a mapping created deliberately, the setting familiar as port forwarding.
Carriers then applied the same trick a second time. Mobile and some fixed-line operators run out of even one-address-per-customer, so they translate their whole subscriber base through shared public addresses, which is carrier-grade NAT: your router's NAT stacked inside the operator's. At that point the crowd behind one address stops being a household and becomes hundreds of unrelated subscribers, with everything that implies for how cautiously sites treat the address.
For proxy work, NAT explains several things that otherwise look odd. Why your machine's own idea of its address never matches what a website reports. Why blocking one address so often has collateral damage. Why some residential supply cannot accept inbound connections at all. And why the eventual fix for all of it, IPv6, restores the one-address-per-device world in which none of this translation is necessary.
Frequently asked questions
What does NAT actually do?
It rewrites traffic at a network boundary so many inside devices can share one public address. Outbound packets get the router's address and a chosen port substituted in, the mapping is recorded, and replies are translated back to the right inside device. The entire arrangement is a table of active conversations, maintained packet by packet.
Is NAT the same as a firewall?
No, though it behaves like a crude one. Unsolicited inbound traffic matches no entry in the translation table and is dropped, which blocks a lot of hostile noise as a side effect. A real firewall makes deliberate policy decisions about traffic in both directions; NAT merely fails to know where to deliver things nobody asked for.
What is the difference between NAT and CGNAT?
Where it runs and how many people share the result. Ordinary NAT runs in your own router and puts one household behind one public address. Carrier-grade NAT runs inside the operator's network and puts many households or many phone subscribers behind each public address, stacked on top of whatever NAT you run at home. The second layer is what makes mobile addresses represent crowds.
Does NAT break proxies?
Outbound use, no: connecting out to a proxy works from behind any normal NAT, which is why home and mobile connections use proxies without special setup. What NAT prevents is being reachable from outside without a deliberate mapping, which is why exits on heavily translated networks are outbound-only and why anything that must accept connections needs either port forwarding or a public address of its own.
Back to the full glossary.