NAT and Subnets: How Network Address Translation Works

NAT and Subnets

NAT (Network Address Translation) is the technology that allows devices on private subnets (using RFC 1918 addresses) to communicate with the public internet by translating their private IP addresses to public ones.

Why NAT Exists

IPv4 only has about 4.3 billion addresses — not enough for every device on Earth. NAT solves this by allowing thousands of devices to share a single public IP address. Internally, devices use private addresses (10.x.x.x, 172.16.x.x, 192.168.x.x), and the NAT device translates these to the public IP when packets leave the network.

Types of NAT

1. SNAT (Source NAT): Translates the source address of outgoing packets from private to public. This is what home routers do — your internal 192.168.1.50 becomes the router's public IP (e.g., 203.0.113.5) for outbound traffic.

2. DNAT (Destination NAT): Translates the destination address of incoming packets from public to private. Used for port forwarding — external traffic to port 80 on the public IP is forwarded to an internal web server at 192.168.1.100.

3. PAT (Port Address Translation): Also called NAT overload, PAT maps multiple private addresses to a single public IP using different port numbers to distinguish sessions. This is the most common form of NAT.

How NAT Relates to Subnets

The subnet design directly affects NAT:

• Internal subnets use private CIDR ranges (e.g., 192.168.1.0/24)
• The NAT device sits at the boundary between private and public networks
• NAT rules reference CIDR blocks to define which internal networks are translated

NAT Table Example

Internal: 192.168.1.50:12345  ->  External: 203.0.113.5:40001
Internal: 192.168.1.51:54321  ->  External: 203.0.113.5:40002

NAT Limitations

• Breaks end-to-end connectivity — external hosts cannot initiate connections to internal hosts without port forwarding
• Complicates protocols like SIP, FTP, and IPsec that embed IP addresses in their payloads
• Adds processing overhead — every packet must be inspected and modified by the NAT device