What is NAT (Network Address Translation)?
What is NAT — how private-to-public IP translation, PAT, and port forwarding work, with iptables examples and interview practice.
Expected Interview Answer
NAT (Network Address Translation) is a technique that maps multiple private IP addresses on an internal network to one or a few public IP addresses, allowing many devices to share a single internet-facing address.
A NAT-enabled router rewrites the source IP and port of outgoing packets to its own public address, tracks the mapping in a translation table, and rewrites the destination back to the correct private address when a reply arrives. This lets an entire home or office network share one public IP, conserving the limited IPv4 address space and hiding internal network topology from the outside. Port Address Translation (PAT), the most common form, differentiates internal hosts by port number since they all share one public IP. Interviewers ask this to check you understand why most home and office devices do not have their own public IP, and how NAT interacts with connection tracking and inbound port forwarding.
- Conserves scarce public IPv4 addresses
- Hides internal network structure from external hosts
- Lets many private devices share one public IP
- Adds a natural barrier against unsolicited inbound connections
AI Mentor Explanation
NAT is like a team manager who is the only one with an official phone number that outsiders can call — when a player wants to contact a sponsor, the manager forwards the call using their own number and remembers which player to route the reply back to. Every player inside the dressing room can reach the outside world through this one shared number, even though none of them has a public number of their own. If the manager loses track of who asked what, the reply cannot find its way back.
Step-by-Step Explanation
Step 1
Outbound packet leaves
A private host sends a packet; the router rewrites the source IP/port to its own public IP.
Step 2
Mapping recorded
The router stores a translation table entry linking the private and public address/port pair.
Step 3
Reply arrives
The router looks up the table and rewrites the destination back to the original private IP/port.
Step 4
Table expires
Idle mappings time out and are removed, freeing the port for reuse.
What Interviewer Expects
- NAT as address translation between private and public IP spaces
- Understanding of the translation table and how return traffic is routed
- Awareness of Port Address Translation (PAT) as the common variant
- Knowledge that NAT complicates unsolicited inbound connections and requires port forwarding
Common Mistakes
- Confusing NAT with a firewall (NAT is address translation, not access control)
- Assuming NAT is a security feature by design rather than a side effect
- Not knowing why hosting a server behind NAT needs port forwarding
- Forgetting NAT is largely unnecessary with IPv6’s vast address space
Best Answer (HR Friendly)
“NAT is like a receptionist for a whole office who forwards every outgoing call through one shared phone number and remembers who to route the reply to. It lets many devices on a private network share a single public internet address, which is why your home router only needs one IP from your ISP even with many devices connected.”
Code Example
# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1
# Masquerade outbound traffic from the private LAN through eth0
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# Forward inbound port 8080 to an internal web server
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.50:80Follow-up Questions
- What is the difference between NAT and PAT?
- Why does hosting a game server behind NAT require port forwarding?
- How does NAT traversal work for protocols like STUN and TURN?
- Does IPv6 eliminate the need for NAT?
MCQ Practice
1. What does NAT primarily allow multiple private devices to do?
NAT maps many private addresses to one (or few) public addresses so devices can share internet access.
2. What does a NAT router use to distinguish multiple internal hosts sharing one public IP?
Port Address Translation differentiates internal hosts by the port assigned during translation.
3. Why does an unsolicited inbound connection typically fail to reach a host behind NAT?
Without an existing outbound-initiated mapping (or explicit port forward), the router has no entry to route the inbound packet to.
Flash Cards
NAT in one line? — Translates private IP addresses to a shared public IP for internet access.
What is PAT? — Port Address Translation — the common NAT variant using port numbers to distinguish hosts.
Why does NAT complicate hosting a server? — Unsolicited inbound traffic has no translation entry, so port forwarding is needed.
Does IPv6 need NAT? — Generally no — its address space is large enough for every device to have a public address.