NAT and PAT | Teleinf Edu

Limited IPv4 space and address translation

IPv4 uses 32-bit addresses, providing about 4.3 billion values. The number of connected devices and networks has exceeded the practical supply of individually assigned public addresses. NAT allows private addresses inside a network and translates selected flows to a router's public address. It does not increase the IPv4 address space or replace IPv6 deployment.

A private network can contain many hosts with local-significance addresses, such as addresses from 192.168.0.0/16. A border router can replace a host's source address with the address of its external interface. For return traffic, it keeps an entry that identifies the internal host and the session parameters. Several devices can therefore use one public address while their translation entries remain separate.

is a function of a border device. The router changes header fields according to its translation table, stores flow state, and reverses the mapping for replies. The entry contains the translation direction and information needed to process replies and expire state. In a typical home network, computers, phones, and other devices use private addresses while the router uses one or more public addresses assigned by the Internet Service Provider (ISP).

Private and public IPv4 addresses

NAT requires a distinction between locally significant addresses and addresses used for routing in the public Internet:

Private IP Addresses

They are intended for use inside a private network, such as a home Wi-Fi network. RFC 1918 gives them local significance. Public Internet routers should not forward packets with these addresses as global source or destination addresses, so communication outside the network requires translation or another explicitly configured mechanism.

The blocks of addresses reserved for private use (defined in ) are:

10.0.0.0 to 10.255.255.255 (10.0.0.0/8)
172.16.0.0 to 172.31.255.255 (172.16.0.0/12)
192.168.0.0 to 192.168.255.255 (192.168.0.0/16)

Public IP Addresses

A public address is assigned with uniqueness within the relevant routing scope and can be advertised in the Internet. An external server sees this address after outbound traffic is translated. A service reachable from outside can use its own public address or the router's address with port forwarding, so the service host does not always need an address assigned directly to its interface.

NAT translates addresses between an internal interface and an external interface. The translation scope, entry lifetime, and permitted traffic depend on the device configuration and the NAT variant in use.

Types of Network Address Translation

Common implementations are static translation, dynamic translation, and address-and-port translation. They differ in how entries are created and how many public addresses are required for the active flows.

1. Static NAT

Static NAT creates a permanent, one-to-one mapping between a private IP address and a public IP address. The entry can support inbound and outbound traffic when the device's access policy permits it.
Use case: Publishing a specified host or service through a fixed translated address.

When a packet comes from the internal device, for example 192.168.1.50, the router translates its source address to the assigned public address, for example 203.0.113.10. Traffic addressed to 203.0.113.10 can be translated to 192.168.1.50 when a matching entry and access rule exist. This is used, among other purposes, to publish a web or mail server with a private address. It does not reduce the number of public addresses needed for this relationship, because each such host requires its own public address.

2. Dynamic NAT

Dynamic NAT maps a pool of private IP addresses to a pool of public IP addresses. The device selects an unused address and maintains the mapping for the session state or for the configured lifetime.
Address allocation: An entry is created for an available pool element and released after it is no longer used.

In this model, an organization has a group of internal devices and a smaller group of public IP addresses. When an internal device starts traffic, the router selects an unused address and creates a temporary one-to-one mapping. The entry remains in the translation table until the session ends or an idle timeout expires. The number of simultaneous mappings cannot exceed the number of available public addresses. When the pool is empty, a new connection cannot obtain a mapping.

3. Port Address Translation (PAT) / NAT Overload

PAT, or NAPT, allows many internal devices to share one public IP address.
Flow distinction: The router distinguishes flows through combinations of addresses and ports and selects a different external port when a collision would occur.

PAT, often called NAT Overload, uses IP addresses and TCP or UDP port numbers to track flows. Its translation entry provides the information needed to deliver a reply to the correct internal host. For TCP, the entry follows the connection state; for UDP, the device uses the observed tuple and an expiration timer. The external port is part of this entry and distinguishes simultaneous flows.

How Port Address Translation (PAT) works

PAT uses port numbers as part of its mapping. An IP address directs a packet to a device, while a identifies a process or service on that device. A port is a 16-bit value ranging from 0 to 65535. A session is distinguished by the source and destination addresses, source and destination ports, and transport protocol. Two sessions can use the same source port when their other tuple elements differ.

PAT uses the external port as part of the public-side mapping. The translation table lets the router recover the internal address and port for a reply packet.

A Step-by-Step Example of PAT in Action

Consider two computers in a home network opening the same website at the same time. The addresses and ports below are example PAT entries.

Your Router's Public IP: 203.0.113.45
Computer A's Private IP: 192.168.1.100
Computer B's Private IP: 192.168.1.101
Website Server's Public IP: 198.51.100.10 (listening on standard web port 443)

Computer A sends a request:Your browser on Computer A wants to connect to the website. It creates a packet. The source address in the packet is 192.168.1.100 and it picks a random, high source port, let's say 12345. The destination is 198.51.100.10:443.
The router performs PAT for Computer A: The packet arrives at the border router. It recognizes outbound traffic and performs translation:
- It replaces the private source IP (192.168.1.100) with its own public source IP (203.0.113.45).
- It replaces the original source port (12345) with a new, unique public port from its available range, let's say 61001. When address or port fields change, the router also updates the relevant transport checksum.
- It records this translation in its NAT table: 192.168.1.100:12345 maps to 203.0.113.45:61001.
- It sends the modified packet out to the internet. The website server sees a request coming from 203.0.113.45:61001.
Simultaneously, Computer B sends a request: Your other device also wants to connect to the same website. It creates a packet with source 192.168.1.101 and picks a different random port, say 54321. Destination is 198.51.100.10:443.
The router performs PAT for Computer B: This second packet also arrives at the router. It performs a similar translation:
- It replaces the source IP 192.168.1.101 with the same public IP 203.0.113.45.
- It replaces the source port 54321 with another unique public port, say 61002.
- It adds a second entry to its NAT table: 192.168.1.101:54321 maps to 203.0.113.45:61002. The destination address and destination port remain the website's values in this outbound example.
- It sends this modified packet out. The server sees a completely separate request coming from 203.0.113.45:61002.
The Reverse Trip: The website server responds. It sends one reply packet back to 203.0.113.45:61001 (for Computer A) and another to 203.0.113.45:61002 (for Computer B).
The Router Translates Back:
- When the packet destined for port 61001 arrives, the router looks it up in its table, finds the entry ... maps to 203.0.113.45:61001, and determines that it belongs to 192.168.1.100:12345. It reverses the translation and forwards the packet to Computer A.
- When the packet for port 61002 arrives, it finds the other entry and correctly forwards that packet to Computer B.

With this port mapping, the router can handle many simultaneous sessions from devices on the local network using one public IP address. The actual number of entries depends on the port range, device resources, and configured limits.

Advantages and limitations of NAT

NAT reduces demand for public IPv4 addresses, while changing how internal devices are visible to other networks.

Advantages

Reduces public IPv4 use: PAT allows many devices to share one public IPv4 address while the router maintains separate port mappings for their flows.
Limits some unsolicited inbound traffic: In many implementations, an incoming packet without a matching state entry is not delivered to an internal host. This behavior does not make NAT a firewall; filtering requires a separate security policy.
Supports internal addressing changes: An administrator can maintain a local address plan independently of the external address. Changing the public address does not necessarily require changing every private host address.

Disadvantages

Changes the end-to-end model: An external server sees the translated address and port rather than the private host address. An inbound connection requires an existing mapping or explicit port forwarding. Applications that place addresses in their payload may also need an application-aware gateway.
Complicates certain applications: Applications that require incoming connections, such as peer-to-peer (P2P) file sharing, some online games, and VoIP protocols, may need port forwarding, STUN, TURN, or another NAT traversal mechanism.
Processing overhead: Modifying IP and transport headers and looking up state consumes router resources and can increase latency. The overhead depends on the device and number of active flows.
Limited traceability: Many hosts can appear under one public address in an external service's logs. Distinguishing them requires translation logs with timestamps and external ports.