Networking · Fundamentals
NAT
Network Address Translation rewrites addresses and ports in transit, most commonly to share public addresses among many private hosts.
IntermediateUpdated 2026-09-01
Overview
Source NAT (often port address translation) lets many internal hosts share one public address for outbound traffic. Destination NAT publishes an internal service on a public address and port. Static NAT maps one address to one address in both directions.
NAT was an answer to IPv4 scarcity, not a security control, though the absence of inbound reachability is a useful side effect. IPv6 designs generally avoid NAT and use firewall policy instead.
How it works
- 01The device maintains a translation table mapping original tuples to translated tuples, with idle timers per protocol.
- 02Outbound flows create state; inbound flows require an explicit destination NAT rule and matching security policy.
- 03Hairpin or NAT reflection allows internal clients to reach a published service by its public name, and is a frequent source of confusion when it is missing.
Security considerations
- NAT hides internal addressing from casual observation but provides no authentication or inspection, pair it with firewall policy.
- Log translations. Without NAT logs, correlating an external report back to an internal host is impossible.
- Carrier grade and large scale NAT reduce attribution fidelity in investigations.
Common misconfigurations
- Publishing a service with destination NAT but forgetting to restrict source addresses.
- Overlapping NAT pools that collide with real internal ranges.
- Translation timeouts shorter than application keepalives, breaking long lived sessions.