What Is NAT? Network Address Translation Explained

NAT (Network Address Translation) is a method used by routers to translate private (internal) IP addresses to a public (external) IP address and vice versa. It allows multiple devices on a local network to share a single public IP address when accessing the internet.

NAT was invented as a practical solution to IPv4 address exhaustion. With only 4.3 billion IPv4 addresses available and billions of internet-connected devices, there simply aren't enough public IPs for every device. NAT allows your home or office to use a single public IP for dozens or even hundreds of devices.

When you check your IP on LookMyIP, you see your public IP — the one your router presents to the outside world. Your individual devices (phone, laptop, smart TV) each have their own private IPs that are invisible to the internet.

Here's what happens when a device on your home network visits a website:

1. Your laptop (private IP 192.168.1.100) sends a request to google.com.
2. The request reaches your router, which replaces the source IP (192.168.1.100) with the router's public IP (e.g., 203.0.113.50) and assigns a unique port number.
3. The router saves this mapping in its NAT translation table: "Port 54321 → 192.168.1.100".
4. Google's server receives the request from 203.0.113.50:54321 and sends its response back.
5. Your router receives the response, checks the NAT table for port 54321, and forwards the data to 192.168.1.100 (your laptop).

The external server never sees your private IP. It only communicates with your router's public IP. This translation happens transparently for every packet flowing through the router.

Static NAT (One-to-One): Maps one private IP to one public IP permanently. Used when a device (like a web server) needs a consistent public IP. Doesn't save addresses, so it's mainly used in business environments.

Dynamic NAT: Assigns public IPs from a pool on a first-come, first-served basis. When a device needs internet access, it gets a public IP from the pool. When it's done, the IP returns to the pool.

PAT (Port Address Translation) / NAT Overload: The most common type — what your home router uses. Multiple devices share one public IP, distinguished by unique port numbers. This is why it's also called "many-to-one" NAT.

CGNAT (Carrier-Grade NAT): Your ISP applies an additional layer of NAT, meaning your "public" IP is actually shared with other ISP customers. This is increasingly common as IPv4 addresses run out. You can detect CGNAT if your router's WAN IP differs from what LookMyIP shows.

Online gaming: NAT can cause issues with multiplayer gaming because incoming connections are blocked by default. Games may report your NAT type as "Strict" or "Moderate," limiting matchmaking. Port forwarding or UPnP can help.

VoIP and video calls: Services like Zoom and Skype use techniques like STUN and TURN servers to work around NAT. Occasionally, NAT causes call quality issues or connection failures.

Peer-to-peer (P2P): BitTorrent, file sharing, and P2P VPNs can struggle behind NAT since both peers may be behind routers that block incoming connections. NAT traversal techniques like hole punching help solve this.

Port forwarding: To run a server (game server, web server, security camera) behind NAT, you need to manually configure port forwarding on your router — telling it to send incoming traffic on a specific port to a specific internal device.

Double NAT: If you have two routers in series (e.g., ISP modem/router + your own router), you get double NAT, which can cause issues with gaming, VPN connections, and port forwarding. The fix is to put one device in bridge mode.

IPv6 was designed to eliminate the need for NAT entirely. With 340 undecillion available IPv6 addresses, every device can have its own globally unique public IP address.

In an IPv6 world, NAT is unnecessary — devices communicate directly with each other using their public IPs, with firewalls handling security instead of NAT providing an incidental security benefit by hiding internal addresses.

However, NAT is so deeply embedded in current networks that the transition away from it will take years. Many organizations use NAT even on IPv6 networks (NAT66) for policy reasons, despite it being technically unnecessary.

Most discussions of NAT stop at the home router. The more consequential deployment today is CGNAT, where your ISP puts thousands of subscribers behind a shared pool of public addresses because it does not have enough IPv4 space to give everyone one.

You can identify it immediately. Check the WAN address on your router and compare it with what the internet sees. If the router shows an address in 100.64.0.0/10 while the IP lookup tool reports something entirely different, you are behind carrier-grade NAT. A second sign is a router WAN address in 10.x or 192.168.x space, which some ISPs use instead.

The practical costs are specific and mostly unfixable from your side:

Port forwarding does nothing. You can configure it perfectly on your own router and it will have no effect, because the ISP's NAT layer above you has no rule sending inbound traffic your way. Self-hosting anything — a game server, a home NAS, a security camera, a personal website — stops working.

Inbound connections fail. Console gaming reports "strict NAT" and matchmaking degrades. Some VoIP and video-calling setups fall back to relayed media, adding latency.

You share reputation with strangers. Rate limits, CAPTCHAs and IP-based blocks applied to the shared address affect everyone behind it. This is why mobile users hit CAPTCHAs far more often than fixed-line users.

Some VPN protocols struggle. Anything relying on protocols without port numbers — notably IPsec in certain modes — needs NAT traversal to work through a second translation layer.

Three workarounds exist. Ask your ISP for a public IPv4 address, which many will provide free or for a small monthly fee. Use IPv6 if your ISP provides it, since CGNAT is an IPv4-only problem and your IPv6 address is globally routable. Or use a tunnel — Cloudflare Tunnel, Tailscale Funnel or a small VPS with a reverse SSH tunnel — which establishes the connection outbound and therefore sidesteps NAT entirely.

If NAT blocks unsolicited inbound connections, video calls between two people who are both behind NAT should be impossible. They are not, and the techniques that make them work are worth understanding because they explain why some calls are crisp and others are laggy.

STUN (Session Traversal Utilities for NAT) is the first step. A client contacts a public STUN server, which simply reports back the source address and port it observed. The client now knows its own public-facing address and port, and can share that with a peer through a signalling channel.

Hole punching follows. Both peers send packets to each other's discovered address simultaneously. Each outbound packet creates a translation entry in that peer's NAT, and the incoming packet from the other side matches it and is allowed through. Neither side technically initiated first, but both NATs believe they did.

Whether this works depends on the NAT's port allocation behaviour. Endpoint-independent NAT reuses the same external port regardless of destination, so the address discovered via STUN is the one the peer can reach — hole punching succeeds. Symmetric NAT allocates a different external port per destination, so the address STUN reported is useless to the peer, and hole punching fails.

TURN (Traversal Using Relays around NAT) is the fallback for that case. All media is relayed through a public server. It always works and it is expensive, since the operator pays for every byte of a call that could have gone directly. This is why WebRTC applications report a "relay" connection type and why those calls have noticeably higher latency.

ICE (Interactive Connectivity Establishment) ties the three together, gathering every candidate address — local, STUN-discovered, TURN-relayed — testing them in parallel and choosing the best that works.

The privacy consequence is the one most people miss: WebRTC's candidate gathering enumerates your local network interfaces and can expose your real IP address even when you are behind a VPN. Test yours with the privacy and leak check.

Consoles report NAT as Open, Moderate or Strict, and those labels map onto well-defined behaviours described in RFC 4787.

Console "Open" corresponds roughly to full cone or a correctly forwarded port, "Moderate" to the restricted variants, and "Strict" to symmetric NAT or double NAT.

Double NAT is the avoidable version of this problem. It occurs when an ISP-supplied modem-router runs NAT and you have connected your own router behind it, which runs NAT again. Two layers of translation make hole punching substantially less likely to succeed. The fix is to put the ISP device into bridge or modem-only mode so that just one device performs NAT. Most ISP hardware supports this even when the option is buried.

You can spot double NAT quickly: log into your own router and look at its WAN address. If it is an RFC 1918 private address (192.168.x.x, 10.x.x.x) then something upstream is translating, and you are either behind an ISP router doing NAT or behind CGNAT.

UPnP and NAT-PMP let applications request port forwards automatically, which is what makes most games work without manual configuration. They are also a genuine security weakness, since any device on your LAN — including a compromised one — can open ports on your router without authentication. Leaving UPnP on is a reasonable trade for a home network; disabling it and forwarding manually is the safer choice if you are willing to do the work.

Does NAT slow down my connection?

Negligibly on any modern router. The translation is a table lookup performed in hardware on most consumer devices. What can degrade is a very large number of simultaneous connections — some routers have small translation tables, and a busy BitTorrent client or a machine under attack can exhaust them, causing new connections to fail while existing ones continue.

How many devices can share one public IP?

In theory the limit is the 65,536 available source ports per external address, and in practice several thousand devices, since each device holds many simultaneous connections. ISPs running CGNAT typically allocate a few hundred to a few thousand ports per subscriber, which is why heavy connection users occasionally see failures on a shared address.

Is NAT going away with IPv6?

Largely. IPv6 has enough addresses that translation is unnecessary, and NAT66 exists but is discouraged. What replaces NAT's accidental protection is an explicit stateful firewall, which every IPv6 router should run and most do by default.

Why can I not access my own server using its public IP from inside my network?

This is NAT loopback, or hairpinning, and many consumer routers do not implement it. The request goes out to the public address, hits the router from the inside, and the router does not know to translate it back in. Workarounds are to use the internal address directly, or to add a local DNS override so the hostname resolves to the internal IP when you are at home.

Does NAT hide my activity from my ISP?

No. NAT hides which device on your network made a request; your ISP still sees every connection leaving your router. It is an addressing mechanism, not a privacy tool.