Port Forwarding and PAT

The most common form of NAT is PAT (Port Address Translation), also called NAT overload. It lets hundreds of devices share a single public IP address by using port numbers to tell their conversations apart.

This is what your home router does: every device behind it reaches the internet through one public address, distinguished only by port.

Every TCP or UDP connection has a source port and a destination port. PAT assigns each internal connection a unique source port on the public address, so each flow is uniquely identified by the combination of public IP and port.

When a reply arrives for a given port, the router looks up its table to find which internal device and port it belongs to, then delivers it correctly.

PAT maintains a table mapping each internal device IP and port to a unique public IP and port pair. For example, two PCs both using port 50000 internally get different translated ports externally.

This mapping is how one public address can carry thousands of simultaneous connections without mixing them up, since each flow has its own unique external port number.

PAT works great for outbound connections, where an internal device starts the conversation. But what about inbound connections, when someone on the internet wants to reach a server inside your network?

The router has no table entry for an unsolicited inbound connection, so it does not know which internal device to send it to and simply drops it. This is where port forwarding comes in.

Port forwarding creates a manual rule: traffic arriving at the public IP on a specific port is forwarded to a chosen internal device and port.

For example, forwarding public port 443 to an internal web server lets people on the internet reach that server through your single public address, even though the server has a private IP behind NAT.

Port forwarding is used to host services from behind NAT:

• A home web or game server reachable from the internet.
• Remote access to a security camera system.
• A self-hosted application accessed from outside.

Each rule maps an external port to one internal device, opening a specific, controlled doorway through the NAT boundary.

This conceptual rule forwards external web traffic to an internal server. Notice how the public port maps to a private device and port.

For a server that must be fully reachable, static NAT maps one public IP to one private IP, one-to-one and permanently. Unlike PAT, the internal server always uses the same dedicated public address.

This suits servers that need consistent, predictable inbound access on many ports, where a single port-forward rule would be insufficient.

Forwarding rules usually target well-known ports tied to specific services. Forwarding port 80 reaches a web server over HTTP, 443 over HTTPS, and 25 a mail server over SMTP.

Knowing which port maps to which service is essential: a wrong port number sends traffic to the wrong place or nowhere at all. Always forward only the exact ports the hosted service actually needs.

Every port-forward rule pokes a hole through your NAT boundary, exposing an internal device to the internet. That device becomes directly attackable, so it must be patched, hardened, and ideally protected by a firewall.

Open only the ports you truly need, restrict source addresses where possible, and never forward sensitive services like RDP or SSH to the open internet without strong protection.

PAT lets many devices share one public IP by giving each flow a unique port, tracked in a translation table, which is ideal for outbound traffic. Port forwarding adds manual rules so inbound traffic reaches a chosen internal device, and static NAT dedicates a public IP to a server. Each opening is a security risk to manage carefully.

Test your PAT and forwarding knowledge.

PAT shares one public IP among many devices using unique port numbers per flow, tracked in a translation table, perfect for outbound traffic. Port forwarding manually maps an external port to an internal device for inbound access, and static NAT dedicates a public IP to a server. Each opening exposes a device and must be secured.