What is NAT (Network Address Translation)?

NAT, or Network Address Translation, is the process of changing IP address information as traffic crosses a network boundary. In a typical UK home network, the broadband router uses NAT so devices with private IPv4 addresses can communicate with the public internet through the connection's public IPv4 address. NAT translates addressing. It is not the same thing as routing, a firewall or CGNAT, even though those functions can exist in the same network path.

The common home IPv4 implementation also translates transport ports, allowing many private devices to share one public address. The IETF describes Basic NAT and Network Address Port Translation, or NAPT, in RFC 3022.

How does NAT work?

When a private device starts an outbound IPv4 connection, the router creates or reuses translation state. It substitutes public-side addressing for the private source information. When the reply arrives, the router uses that state to reverse the translation and deliver the packet to the correct internal device.

1. A device sends traffic using its private IPv4 address and source port.

2. The router receives the packet at the private-to-public boundary.

3. NAT records a mapping between internal and external address and port information.

4. The packet leaves using the translated public-side information.

5. Return traffic matches the active mapping.

6. The router reverses the translation and forwards the packet to the originating device.

A worked NAT example

A laptop at 192.168.1.10 might open an HTTPS connection from TCP port 51514. The router could represent that flow externally as 203.0.113.25:62001. A phone can use the same public IPv4 address with another translated port. These are documentation addresses used only to illustrate the mapping.

• Laptop inside LAN: 192.168.1.10:51514

• Translated public side: 203.0.113.25:62001

• Remote HTTPS service: destination port 443

• Return traffic to the translated tuple can be mapped back to the laptop.

Techie Broadband practical interpretation: a single public IPv4 address can represent many simultaneous internal conversations because translation state distinguishes the individual flows. NAT does not increase broadband speed or bandwidth.

NAT vs NAPT or PAT

Basic NAT maps IP addresses. NAPT extends translation to TCP or UDP port information, allowing multiple private endpoints to share a single public address. Consumer documentation often uses NAT as the umbrella term even when the router is technically performing address and port translation.

Private IP addresses, public IP addresses and NAT

A private IP address is used inside the local network and is not globally routed across the public internet. NAT sits at a boundary and translates between the addressing used on the private side and the addressing used externally.

• Private IPv4 identifies a device inside the local network.

• Public IPv4 identifies the internet-facing side of the connection or translation system.

• NAT maintains translation state between the two sides.

• Routing decides where packets go next. NAT changes address information.

NAT is not a firewall

NAT and firewalling are often combined in the same router. NAT translates address or port information. A firewall applies policy about which traffic is allowed or blocked. The common failure of unsolicited inbound traffic through consumer NAT should not be treated as proof that translation itself is a security policy.

The IETF's RFC 4787 separates NAT mapping behaviour from filtering behaviour, a useful distinction when diagnosing applications that need inbound or peer-to-peer connectivity.

NAT vs CGNAT

Home NAT and CGNAT perform translation at different points. Home NAT normally happens in the customer router. Carrier-Grade NAT happens inside the ISP network and can share public IPv4 addresses across multiple broadband customers.

• Home NAT translates household devices at the customer router.

• CGNAT translates customer connections inside the ISP network.

• Both can exist, creating two IPv4 translation layers.

• A home port forward cannot by itself create an inbound path through upstream CGNAT.

The IETF's RFC 6888 defines common requirements for carrier-grade NATs and builds on NAT behavioural guidance for protocols including UDP, TCP and ICMP.

NAT vs static and dynamic public IP

NAT is separate from whether the public address is static or dynamic. Static versus dynamic describes address assignment consistency. NAT describes translation between address realms.

Why port forwarding is needed for inbound services

Outbound traffic gives the router context to create translation state. An unsolicited inbound connection is different because the router needs to know which internal device should receive it. A port-forwarding rule creates a deliberate inbound mapping for a selected protocol and port.

• Self-hosted services may need a defined inbound mapping.

• Remote-access VPN servers may need an inbound protocol or port.

• Games and peer-to-peer applications may use automatic NAT traversal mechanisms.

• Port forwarding on the home router cannot bypass ISP CGNAT.

NAT traversal, gaming and real-time applications

NAT can complicate applications that expect peers to communicate directly or that carry addressing information in application data. Gaming, voice, video and peer-to-peer software can therefore use traversal techniques to discover mappings, negotiate reachable candidates or relay traffic when direct connectivity is unavailable.

RFC 4787 documents behaviours intended to improve consistency for applications including multimedia and online gaming. Consumer labels such as open, moderate and strict NAT should not be treated as universal protocol classifications.

TCP, UDP, ICMP and NAT state

TCP and UDP flows can be distinguished using addresses and ports. ICMP has different identifiers and error-message considerations. Translation devices also need to handle mapping timeouts, fragments and state expiry. This is why the shorthand description 'NAT changes one IP address into another' is incomplete.

Related Techie Broadband references include ICMP and packet fragmentation.

Does NAT affect broadband speed or latency?

NAT is not a speed tier and does not increase bandwidth. Translation requires router processing. On suitable modern hardware the practical effect can be small, but on fast FTTP and multi-gigabit services router forwarding and NAT throughput can become a bottleneck if the hardware cannot process traffic at the required rate.

• A 1 Gbps service needs a router capable of forwarding and translating close to that rate for near-gigabit wired results.

• At 2.5 Gbps and above, router CPU, interfaces or acceleration can become visible constraints.

• WiFi, server capacity and protocol overhead can remain bottlenecks even when NAT performance is adequate.

• CGNAT adds translation upstream, but latency depends on the complete path rather than NAT alone.

NAT and IPv6

IPv6 has a vastly larger address space, so ordinary internet access does not need IPv4-style address sharing simply to conserve globally unique addresses. IPv6 networks still use firewalls and routing policy. The absence of NAT does not mean the absence of security controls.

A dual-stack UK broadband service can therefore use NAT for IPv4 while IPv6 uses globally scoped addressing with stateful firewall policy. The exact arrangement depends on ISP, access network, product, router and location.

Common NAT misconceptions

• NAT is not the same as a firewall.

• NAT is not the same as CGNAT.

• A static public IP does not mean NAT is disabled inside the home.

• A dynamic public IP does not itself define whether home NAT is used.

• Port forwarding does not create a path through upstream CGNAT.

• NAT does not inherently improve download speed, upload speed or latency.

• IPv6 does not require IPv4-style sharing for ordinary address conservation.

How to diagnose NAT or CGNAT blocking an inbound service

For an inbound connectivity problem, diagnose the address path before changing random router settings.

1. Check the WAN IPv4 address shown by the router.

2. Compare it with the public IPv4 address reported by an external service.

3. If they differ, determine whether another local router or an ISP translation layer exists upstream.

4. Give the intended internal device a stable local address or DHCP reservation.

5. Confirm the service is listening on the expected protocol and port.

6. Check the router port-forwarding rule and firewall policy.

7. Test from a genuinely external network.

8. If CGNAT is present, check whether the ISP offers public IPv4 or use an appropriate alternative such as IPv6, an outbound tunnel or relay.

NAT on UK broadband

There is no single NAT design used by every UK broadband service. A connection may receive public IPv4 directly at the router, use CGNAT, offer static public IPv4, provide native IPv6 or combine these differently. Capabilities must be checked at ISP + access network + product + location level.

For ordinary browsing, streaming and cloud services, home NAT is usually transparent. It becomes much more important for self-hosting, inbound VPNs, IP allowlists, peer-to-peer applications, consoles and real-time communications.

Key takeaway

NAT is an address-translation mechanism, not a broadband speed feature. In the common home IPv4 case it lets multiple private devices communicate through a public address by maintaining mappings between internal and external traffic. Understanding where NAT occurs, and whether CGNAT adds another layer upstream, is essential when diagnosing inbound connectivity.

NAT FAQs

What does NAT stand for?

NAT stands for Network Address Translation. It describes changing IP addressing information as traffic crosses between network realms.

Why do home routers use NAT?

The common IPv4 reason is to let multiple private devices communicate through the broadband connection's public IPv4 address while the router tracks individual flows.

Is NAT the same as CGNAT?

No. Home NAT normally occurs in your router. CGNAT occurs in the ISP network and can share public IPv4 addresses across multiple customers.

Does NAT hide my private IP address?

Remote internet services normally see the translated public-side address rather than a device's private IPv4 address. That does not make NAT an anonymity system.

Does NAT make broadband safer?

NAT often accompanies stateful filtering in consumer routers, but translation and firewall policy are different functions. Security depends on the actual filtering and configuration.

Can I port forward through CGNAT?

A port forward on your own router cannot create a matching inbound mapping in an ISP's upstream CGNAT. You need a public-address option or another connectivity method.

Do I need NAT with IPv6?

IPv6 does not need IPv4-style address sharing simply to conserve public addresses. IPv6 security is normally handled with firewall policy rather than relying on address translation.

To explore the related technical concepts used in this NAT (Network Address Translation) guide, visit our broadband terminology guide.