What is NAT and Port Translation (NAPT)?
Learn what NAT and Port Address Translation (PAT/NAPT) are, how the translation table works, and why they matter for IPv4.
Expected Interview Answer
NAT (Network Address Translation) is the process a router or gateway uses to rewrite the source or destination IP address of a packet as it crosses network boundaries, and Port Address Translation (PAT, also called NAPT) extends this by also rewriting the source port so many internal devices sharing one private network can share a single public IP address simultaneously.
In the most common form, NAPT, a router maintains a translation table: when an internal device with a private IP (e.g., 192.168.1.10) sends a packet out to the internet, the router rewrites the source IP to its own public address and assigns a unique source port (e.g., 51000) to that connection, recording the mapping. When the reply comes back addressed to the public IP and that port, the router looks up the table and rewrites the destination back to the original private IP and port before delivering it internally. This lets an entire private network of many devices share one scarce public IPv4 address, since each outbound connection is distinguished by its unique port rather than a whole address. NAT also provides a side benefit of obscuring internal network structure from the outside, though it is not a substitute for a firewall, and it complicates protocols that embed IP addresses in their payload (like some VoIP or FTP flows), which is why NAT traversal techniques such as STUN and TURN exist.
- Lets many private devices share one public IPv4 address
- Conserves scarce public IPv4 address space
- Obscures internal network topology from external observers
- Maintains per-connection state via unique source ports
AI Mentor Explanation
NAT/PAT is like a team hotel with one shared front-desk phone line handling calls for dozens of players staying inside. When a player calls out, the front desk notes which room made the call and assigns it a temporary line extension, so the outside party sees only the hotel’s main number plus that extension. When the reply call comes back to that specific extension, the front desk looks up its log and routes it to the correct room. Many players can be on calls simultaneously through the one shared line because each call gets its own extension, exactly like PAT assigning a unique port per connection.
Step-by-Step Explanation
Step 1
Outbound packet arrives at the router
An internal device with a private IP sends a packet destined for the public internet through the NAT gateway.
Step 2
Rewrite source and assign a port
The router replaces the private source IP with its own public IP and assigns a unique source port, recording the mapping in its translation table.
Step 3
Packet travels and a reply returns
The external server responds to the public IP and that specific port; the reply is routed back to the NAT gateway.
Step 4
Reverse translation and delivery
The router looks up the port in its translation table, rewrites the destination back to the original private IP and port, and delivers the packet internally.
What Interviewer Expects
- Distinguishes basic NAT (IP-only) from NAPT/PAT (IP + port)
- Explains the translation table mapping private IP:port to public IP:port
- Understands why NAT conserves public IPv4 addresses
- Aware that NAT complicates protocols embedding IP addresses in payloads
Common Mistakes
- Treating NAT as a security firewall rather than an address-sharing mechanism
- Forgetting that PAT relies on unique source ports, not just IP rewriting
- Assuming NAT is needed under IPv6 given its vastly larger address space
- Not knowing NAT traversal techniques like STUN/TURN exist for embedded-IP protocols
Best Answer (HR Friendly)
“NAT is how your home router lets every device — your laptop, phone, smart TV — share one single public internet address. It keeps track of which device made which outgoing request by assigning each one a unique port number, so when the reply comes back, the router knows exactly which device to hand it to. That is what lets your whole household get online with just one public IP address from your internet provider.”
Code Example
# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Masquerade (PAT) all traffic from the internal LAN going out eth0
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
# Inspect active NAT translations
conntrack -L | grep MASQUERADEFollow-up Questions
- What is the difference between basic NAT and PAT (NAPT)?
- Why does NAT complicate protocols like FTP or SIP that embed IP addresses?
- What are STUN and TURN and how do they help with NAT traversal?
- Why is NAT largely unnecessary in an IPv6-only network?
MCQ Practice
1. What does PAT (NAPT) add on top of basic NAT?
PAT/NAPT rewrites the source port so multiple internal devices can share a single public IP simultaneously.
2. What does a NAT router use to correctly deliver a reply packet to the right internal device?
The router consults its translation table entry created during the outbound request to route the reply correctly.
3. Why does NAT complicate some VoIP or FTP connections?
Protocols that embed IP/port info in their application payload break unless NAT-aware handling or traversal (STUN/TURN) is used.
Flash Cards
What is NAT? — A technique that rewrites IP addresses (and with PAT, ports) as packets cross a network boundary.
What does PAT add over basic NAT? — Port rewriting, letting many devices share one public IP simultaneously.
What does the router use to route replies back correctly? — Its NAT translation table mapping public IP:port to private IP:port.
Why does NAT complicate FTP/VoIP? — Those protocols embed IP addresses in the payload, which plain NAT does not rewrite.