What is NAT?

Network Address Translation (NAT) is the process of rewriting IP addresses in packet headers as traffic crosses a device, mapping addresses from one address space into another. It lets networks built on private, unregistered IP addresses reach the public internet through a small set of shared public addresses.

Key takeaways

• NAT rewrites source or destination IP addresses as packets cross a device.
• Static NAT maps one private address to one public address permanently.
• Dynamic NAT and NAPT share a pool of public addresses among many hosts.
• NAT conserves scarce public IPv4 addresses and hides internal topology.
• Versa configures every NAT mode through CGNAT pools and rules on VOS.

On this page: Why it matters · How it works · Types · NAT & Versa · FAQ

Why is NAT important?

NAT solved IPv4 address exhaustion long before the industry finished moving to IPv6, and it is a large part of why that move still isn’t finished. Instead of assigning every device a scarce public IPv4 address, an organization addresses internal hosts from private ranges and translates only at the network edge, sharing a handful of public addresses across an office or subscriber base.

The security payoff is inseparable from the addressing payoff: internal addressing never appears on the public internet, so NAT also hides a network’s topology from outside observers, acting as a rudimentary filter since an unsolicited inbound connection has no existing mapping to ride in on. That is why NAT sits at nearly every network edge today, from a home router to a carrier core.

What is NAT?

A NAT-capable device – a router, firewall, or SD-WAN appliance – rewrites the source or destination IP address, and often the port, in a packet’s header as it crosses, then tracks the mapping so return traffic finds its way back. The device consults rules that define which traffic to translate and a pool of addresses to translate into.

Two properties describe most implementations: which address gets rewritten (source, destination, or both) and how many private addresses share each public one (one-to-one static mapping versus many-to-few dynamic sharing). When many addresses share few public ones, the device also rewrites source ports – network address and port translation (NAPT) – to distinguish thousands of concurrent sessions on one address. Timeouts reclaim mappings once a session goes idle.

Types of NAT

Four core modes cover most deployments. Static (basic) NAT maps one private address to one public address permanently – used when a host, such as a server, must stay reachable at a consistent external address. Dynamic NAT draws a public address from a pool on demand, releasing it when the session ends, still one-to-one at any moment. NAPT, also called port address translation, shares one public address among many hosts by also rewriting source ports – the mode behind most home and office connections. Destination NAT (DNAT) rewrites the destination instead of the source, commonly used for port forwarding: exposing an internal server at a public address and port.

At larger scale, carrier-grade NAT (CGNAT) applies NAPT across an entire subscriber base from a shared, provider-operated pool – different enough to get its own glossary entry.

NAT & Versa

Versa implements every NAT mode above as a single configurable service. On VOS devices, administrators configure CGNAT pools and rules in Director, choosing a NAT mode per rule – Basic NAT-44, DNAT-44, Dynamic NAT-44, NAPT-44, and twice-NAT variants – whether the deployment is a single branch or a provider-scale rollout. The same rule engine handles NPT-66 for stateless IPv6 prefix translation and NAT64/DNS64 for interworking between IPv6-only clients and IPv4-only servers.

In Concerto, the equivalent function is CGNAT policies built into SD-WAN main templates, adding a Port Forwarding mode that simplifies exposing an internal service without a full destination-NAT rule. Because NAT rewrites addresses some protocols embed in their payload – FTP, SIP, TFTP – Versa pairs NAT rules with Application Layer Gateway policies so those protocols keep working across a translated path. Versa’s article digest tracks NAT configuration walkthroughs and CLI verification commands as they publish.

Frequently asked questions

What is the difference between NAT and CGNAT?

NAT is the general address-translation mechanism; CGNAT is NAT applied at carrier scale, sharing one public IP pool across thousands of subscribers using large-scale NAPT. Ordinary NAT typically serves one organization behind one gateway; CGNAT is provider-operated and shared across unrelated subscribers.

What is the difference between source NAT and destination NAT?

Source NAT rewrites a packet’s source address, typically for outbound traffic leaving a private network for the internet. Destination NAT rewrites the destination address, typically for inbound traffic reaching an internal server – the mechanism behind port forwarding and exposing internal services externally.

Why does NAT break some application protocols?

Protocols that embed IP addresses or ports inside their payload – FTP, SIP, TFTP – break under plain NAT because the device only rewrites packet headers, not payload content. Application Layer Gateways inspect and rewrite those embedded addresses and open the matching firewall pinholes dynamically.

Does NAT provide security on its own?

NAT provides incidental security: an unsolicited inbound connection has no existing translation mapping to follow, so it is dropped by default. It is not a substitute for a firewall – stateful inspection, access rules, and threat prevention still do the deliberate security enforcement.

Is NAT still necessary now that IPv6 exists?

Yes, for the foreseeable future. Most networks run dual-stack or remain IPv4-only, and NAT still connects private IPv4 networks to the public internet. NAT64 additionally lets IPv6-only clients reach the remaining IPv4-only services during a transition that is likely to take years to complete.

More on NAT

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about NAT, these are worth looking at next.