How NAT works
When a device sends traffic outside its local network, the NAT router replaces its private source address with a public address. In the common many-to-one form, it also assigns a different source port and records the mapping.
Device:51514 → NAT router → source 198.51.100.25:62001 → internetWhen a reply arrives at 198.51.100.25:62001, the router looks up the entry, restores the device’s private destination and forwards the packet. Each entry records the original and translated address-port tuples and protocol, then expires based on protocol state or an idle timeout.
This sharing helps conserve public IPv4 addresses. It is less necessary for IPv6 because IPv6 has a much larger address space.
Types of NAT
- Static NAT: keeps a fixed one-to-one mapping between a private address and a public address.
- Dynamic NAT: temporarily assigns a public address from a pool. The mapping may differ on a later connection.
- Port Address Translation: lets many devices share one public address by assigning distinct ports. It is also called PAT, NAPT or NAT overload.
CGNAT applies similar sharing within an ISP’s network. Multiple customers may appear online through the same public address.
NAT vs forward proxy
Both can change the source address seen downstream, but they handle traffic differently.
| Aspect | NAT | Forward proxy |
|---|---|---|
| Traffic handling | Rewrites packet headers | Accepts and relays connections |
| Client setup | Usually handled by the gateway | Usually configured in the app or OS |
| Website sees | NAT gateway’s public address | Proxy’s exit address |
A forward proxy is an intentional intermediary selected for specific traffic. NAT is usually a gateway function applied automatically to routed traffic.
How NAT affects proxy connections
With a proxy configured, the path is device → NAT gateway → proxy → website. The proxy normally sees the NAT gateway’s public address, while the website sees the proxy’s exit address.
- Source-IP authentication: If a proxy uses IP whitelisting, allowlist the NAT gateway’s public address rather than the device’s private address.
- Idle connections: NAT mappings can expire after inactivity. A long-lived proxy tunnel may then disconnect and need a keepalive or reconnection.
- Inbound access: Connecting to a proxy is normally outbound and needs no port forwarding. Hosting a proxy behind NAT requires an explicit mapping and appropriate firewall rules.
FAQ
Can a website see my IP through NAT?
Yes, but it sees the NAT gateway’s public address rather than your device’s private address. If you use a proxy, the website normally sees the proxy’s exit address instead.
Is NAT a firewall?
No. NAT translates addresses and ports but doesn’t enforce a firewall security policy. Home routers often combine NAT with a stateful firewall that rejects unsolicited inbound connections.
Does IPv6 need NAT?
Usually not for address conservation. IPv6 devices can use globally routable addresses while a firewall controls inbound access, though IPv6-to-IPv6 translation technologies do exist.