networks//NAT

**Network address translation** (NAT) is a router function that rewrites the addresses and ports of packets crossing it, so that many devices on a private network share one public IPv4 address. It exists because IPv4 has about 4.3 billion addresses and the world has far more devices; almost every home router and every mobile network does it, and it is the reason a laptop at home cannot be reached from the outside without help.

Network address translation (NAT) is a router function that rewrites the addresses and ports of packets crossing it, so that many devices on a private network share one public IPv4 address. It exists because IPv4 has about 4.3 billion addresses and the world has far more devices; almost every home router and every mobile network does it, and it is the reason a laptop at home cannot be reached from the outside without help.

The mechanism is a table. When the laptop at 192.168.1.20 sends a UDP packet from port 41641 to a server, the router replaces the source with its own public address and a port it picks, say 203.0.113.45:54720, and writes that pair into its table. A reply to 203.0.113.45:54720 is translated back and delivered to the laptop. A packet that arrives on the public side with no matching entry has nowhere to go and is dropped, which is why every connection through NAT has to be opened from the inside.

Outbound opens, inbound is refused.

A NAT behaves like a firewall that only admits answers to questions the inside asked. Reaching a device behind it means getting that device to ask first: a forwarded port, a relay both sides dial, or NAT traversal.

Carrier-grade NAT (CGNAT) puts a second translation in the operator's network, so a phone on 4G or a home on some fibre plans has no public address at all, only a slot on a shared one. The operator side uses the shared range 100.64.0.0/10 set aside for it, which some overlay networks borrow for their own addresses for the same reason: it never appears on the public internet.

NATs differ in how they choose the outside port. With endpoint-independent mapping the same inside address and port keep the same outside port whatever the destination; with endpoint-dependent mapping (often called symmetric NAT) every destination gets a new one. The difference decides whether two devices behind NATs can meet directly (NAT traversal).

Entries expire after a period of silence, often tens of seconds for UDP, so a long-lived path through a NAT needs small periodic packets to keep its entry alive.

NAT is not a security boundary by design, only by side effect: it hides inside addresses and refuses unsolicited packets, but a forwarded port exposes the device behind it to the whole internet. IPv6 removes the address shortage and with it most of the reason for NAT, which is why the same networks often reach devices over IPv6 without translation.