How does NAT allow multiple private devices to access the Internet through one public IP address?
Interview preparation resource from Gate Smashers.
NAT allows private devices to reach the Internet through one public IPv4 address by using Port Address Translation (PAT), also called NAPT or NAT overload. For each outbound flow, the NAT gateway replaces the private source IP address and port with its public IP address and a translated port, then records the mapping. Reply packets sent to that public IP and translated port are matched against the table, rewritten with the original private destination IP and port, and delivered to the correct internal device.
NAT and private addressing
Private IP addresses are not globally routable on the public Internet. A NAT gateway at the network edge translates addresses in packets crossing between a private network and the Internet.
How PAT shares one public address
Basic NAT can use multiple public addresses, but PAT is the mechanism commonly used to let many devices share one public IPv4 address. It distinguishes simultaneous communications by using transport-layer port numbers, along with the relevant protocol and address information.
When an internal device sends traffic outward, the gateway replaces the packet's private source address with its public address. It assigns or selects an external source port so that the flow can be uniquely tracked.
- Internal flow: A private host sends a packet with its private source IP address and source port.
- Translated flow: The NAT gateway sends it to the Internet with the gateway's public IP address and a tracked external port.
Translation table and return traffic
The NAT gateway maintains a translation table for active flows. The entry associates the internal endpoint with the public address and translated port used externally.
When a reply arrives at the public IP address and translated port, the gateway finds the matching entry, changes the destination back to the internal IP address and port, updates packet checksums as required, and forwards the packet to the intended device. This keeps traffic for different private devices and connections separate.
What NAT does and does not provide
PAT conserves public IPv4 addresses and prevents private addressing details from being directly visible in outbound packets. NAT is not, by itself, a replacement for a firewall: firewalling requires explicit traffic-control policy and may include additional inspection capabilities.