Network Address Translation (NAT) Explained for GCSE Computer Science

Network Address Translation (NAT) is a router function that allows all devices on a private network to share one public IP address when connecting to the internet. The router maintains a table mapping private addresses to outgoing requests, rewriting packet headers in both directions.

What problem does NAT solve?

IPv4 addresses are 32 bits long, which means there are at most 2³² = approximately 4.3 billion unique addresses. In the early days of the internet, this seemed more than sufficient. By the mid-1990s it was clear it was not: the internet was growing faster than anyone had predicted, and 4.3 billion addresses would eventually be exhausted.

NAT was introduced in 1994 as a pragmatic solution. Instead of every device needing its own globally unique IPv4 address, an entire household or office could share a single public address. The router acts as an intermediary, translating between the many private addresses inside the network and the single public address that the outside world sees.

Without NAT, every laptop, phone, printer, and smart speaker in your home would require its own public IP address. With NAT, your entire home uses just one, provided by your Internet Service Provider (ISP).

What is the difference between private and public IP addresses?

Public IP addresses are globally unique and routable on the internet. Your ISP assigns your router one public address. Every website or server you visit sees this address as the source.

Private IP addresses are reserved ranges that can be reused by any home or office network. They are not routable on the public internet — a device with a private address cannot be directly accessed from outside without special configuration.

The three private IPv4 address ranges defined in RFC 1918 are:

Your home devices almost certainly have addresses starting with 192.168. — these are private addresses, invisible and unreachable from the public internet.

How does NAT work step by step?

Scenario: Your laptop (private address 192.168.1.5) requests a web page from a server at 93.184.216.34 (the public address of a website).

1. Outgoing request: Your laptop sends a packet with:

   • Source IP: 192.168.1.5 (private)
   • Destination IP: 93.184.216.34
   • Source port: 54321 (a randomly chosen high port)

2. NAT translation (outgoing): Your router receives the packet, replaces the source address with its own public IP (say 82.0.0.1), and records the mapping in its NAT translation table:

   Private IP	Private port	Public IP	Public port
   192.168.1.5	54321	82.0.0.1	60001

3. Request reaches the server: The web server receives a packet from 82.0.0.1 port 60001. It has no knowledge of the private network behind the router.

4. Server replies: The server sends data back to 82.0.0.1 port 60001.

5. NAT translation (incoming): The router receives the reply, looks up port 60001 in its translation table, and rewrites the destination address back to 192.168.1.5 port 54321. It forwards the packet to your laptop.

Your laptop receives the reply as if it connected directly. The entire translation is transparent.

What is a NAT translation table?

The NAT translation table (also called the NAT table or connection tracking table) is the data structure the router maintains to track active connections. Each entry maps one private IP + port combination to one public port number. This allows the router to support many simultaneous connections from many devices — all sharing the same public IP address — by distinguishing them by port number.

Example NAT table:

When an incoming packet arrives, the router looks up the public port to find the correct private address and forwards the packet accordingly.

What are the benefits and limitations of NAT?

Frequently asked questions

Is NAT a security feature?

NAT provides a side-effect security benefit: devices on the private network are not directly addressable from the internet, so unsolicited incoming connections are automatically dropped (there is no NAT table entry to match them). However, NAT is not designed as a security measure and should not replace a proper firewall. It does not protect against outbound malware, phishing, or attacks that the user initiates by clicking a link.

What is the difference between NAT and PAT?

Port Address Translation (PAT) is the specific form of NAT that uses port numbers to distinguish connections — the type described throughout this article. Some textbooks use "NAT" to refer to a simpler one-to-one mapping (one private IP to one public IP), and "PAT" or "NAPT" (Network Address and Port Translation) to refer to the many-to-one mapping used in home routers. For GCSE purposes, the term NAT typically refers to the many-to-one type described here.

Why does IPv6 reduce the need for NAT?

IPv6 addresses are 128 bits long, providing 2¹²⁸ ≈ 340 undecillion unique addresses — a number so large that every atom on Earth could have several IP addresses. With IPv6, every device can have a globally unique, publicly routable address, eliminating the address-scarcity problem that NAT was invented to solve. Many modern networks run both IPv4 and IPv6 simultaneously (called dual-stack) during the transition period.

Can two devices behind NAT connect directly to each other (peer-to-peer)?

Direct peer-to-peer communication between devices behind different NAT routers is difficult because neither device has a directly reachable public address. Techniques such as STUN (Session Traversal Utilities for NAT) allow devices to discover their public address and port, and UDP hole punching allows them to establish a direct connection by simultaneously sending packets to each other. Video calling apps and online games use these techniques internally to establish direct connections even behind NAT.

Master networking concepts including IP addressing and protocols with Professor Turing's GCSE tutoring at aitutors.me.