How NAT Shares One Public IP

The internet uses IPv4 addresses, of which there are only about 4.3 billion, far fewer than the number of devices online today. Buying a public address for every phone, laptop, and gadget is impossible.

NAT (Network Address Translation) is the clever fix: it lets many devices on a private network share a single public IP address to reach the internet, conserving the limited supply.

Networks use private IP ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) internally. These are not routable on the public internet, so they cannot be used directly online.

A public IP address is globally unique and internet-routable. NAT bridges the two worlds, translating between private internal addresses and the public address that the internet sees.

NAT typically runs on the router or firewall at the edge of a network, the boundary between the private LAN and the public internet. Your home router is doing NAT right now.

This edge device holds the single public address (assigned by your ISP) on its outside interface and the private network on its inside, performing translation for every device behind it.

When an internal device sends a packet to the internet, NAT rewrites the source address from the private IP to the router public IP. To the destination server, the traffic appears to come from the public address.

When the reply returns, NAT rewrites the destination back to the correct private address and delivers it to the right internal device, all transparently.

NAT keeps a translation table that maps each internal conversation to an outside one, so replies can be matched back to the right device. Without it, the router would not know which internal host a returning packet belongs to.

Each entry tracks the internal address, the external address, and identifying details so dozens of simultaneous connections can share one public IP without confusion.

There are a few NAT styles:

• Static NAT: a fixed one-to-one mapping between one private and one public address.
• Dynamic NAT: private addresses map to a pool of public addresses as needed.
• PAT (Port Address Translation): many devices share one public IP using port numbers, the most common form at home.

NAT was created to save addresses, but it adds a security bonus. Because internal devices have private, non-routable addresses hidden behind one public IP, the internet cannot directly initiate a connection to them.

This is not a real firewall, and should not be relied on as one, but it does naturally obscure the internal network and block unsolicited inbound traffic by default.

NAT became essential because IPv4 addresses are scarce. IPv6, with its enormous address space, gives every device a unique global address, so traditional NAT is largely unnecessary there.

Still, NAT remains everywhere because IPv4 is far from gone. Understanding it is vital, even as the world slowly transitions toward the abundant addressing of IPv6.

Picture a home with several devices, each with a private address like 192.168.1.10 and 192.168.1.11. The router holds one public address from the ISP, say 203.0.113.5.

When any device browses the web, the router rewrites its private source address to 203.0.113.5 before sending the packet out. Every device shares that single public identity online, yet the router translation table ensures each reply finds its way back to the right device.

NAT is not free of trouble. It can break protocols that embed IP addresses inside their data or that need inbound connections, like some voice (VoIP) and peer-to-peer applications.

Workarounds include port forwarding, application-layer gateways, and protocols designed to traverse NAT. These complications are the price paid for stretching the limited IPv4 address space so far.

NAT lets many private devices share one public IP, conserving scarce IPv4 addresses. It runs on the edge router or firewall, rewriting source and destination addresses and tracking conversations in a translation table. It comes in static, dynamic, and PAT forms, adds a security side effect, and is largely unneeded under IPv6.

Test your NAT basics.

NAT translates between private internal addresses and a shared public IP, conserving scarce IPv4 space. It runs on the edge router/firewall, rewriting addresses and tracking flows in a translation table, in static, dynamic, or PAT forms. It also hides internal hosts from unsolicited inbound traffic and is largely unneeded under IPv6.