NAT vs PAT: How Address Translation Works and Why Networks Need It

Network Address Translation rewrites IP addresses in packet headers as they cross a router boundary. Port Address Translation extends that by rewriting port numbers too, so many internal hosts can share one public address. On the Network+ exam the distinction between the two is a reliable question, and the reasoning behind it explains most of how home and office internet access actually works.

Why translation exists

IPv4 has roughly 4.3 billion addresses and far more than that many connected devices. The reserved RFC 1918 private ranges — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — can be reused by every organization simultaneously because they are never routed on the public internet.

That reuse is only useful if private hosts can still reach the internet, and that is the job of translation. The router swaps the private source address for a public one on the way out and reverses the swap on the way back.

The three flavors

Static NAT maps one private address to one public address permanently. Use it when an internal server must be reachable from outside at a predictable address — a mail server or a web server in a DMZ. It consumes one public address per host and provides no conservation benefit at all; its purpose is reachability.

Dynamic NAT draws from a pool of public addresses, assigning one to an internal host for the duration of its session and returning it afterward. It conserves addresses only to the extent that not everyone is online at once. When the pool is exhausted, additional hosts simply cannot get out.

PAT, also called NAT overload or many-to-one NAT, maps every internal host to the same public address and distinguishes between them using source port numbers. This is the form nearly every network actually runs.

How PAT keeps sessions straight

When an internal host at 192.168.1.50 opens a connection from source port 51234 to a web server, the router rewrites the source to its public address and, if needed, to a new source port — say 62001. It records the mapping in a translation table: public address port 62001 corresponds to 192.168.1.50 port 51234.

A second host at 192.168.1.51 also using port 51234 gets a different translated port, 62002, so the two sessions never collide. When replies arrive, the router looks up the destination port in its table and rewrites the packet back to the correct internal host and port. Because the port field is 16 bits, a single public address can theoretically carry tens of thousands of concurrent sessions, which is why one address serves an entire office. Understanding which port numbers belong to which services helps here: the destination port stays intact, and only the ephemeral source port is rewritten.

Port forwarding and the inbound problem

PAT builds its table from outbound traffic, so an unsolicited inbound packet has no entry to match and is dropped. That breaks hosting anything internally. Port forwarding fixes it with a static rule: traffic arriving on a given public port is sent to a specified internal address and port, which is functionally static NAT applied at the port level rather than the address level.

What it does and does not do for security

PAT is often described as a security feature because internal hosts are unreachable from outside by default and internal addressing is hidden. Both effects are real, but both are side effects of address conservation, not deliberate security design.

Translation inspects nothing. It does not filter traffic, block malicious content, stop outbound connections from compromised hosts, or protect against anything a user initiates — and a user clicking a link initiates the connection that lets an attacker back in. Treat it as obscurity, and put a real firewall in the path for control. On the exam, "NAT is not a substitute for a firewall" is the position to hold.

IPv6, with an address space large enough to give every device a globally unique address, removes the conservation motive entirely. Translation persists there only in narrow transition scenarios, and security is expected to come from firewalling rather than from the accident of unreachability.

Exam angles

Know static NAT as one-to-one, dynamic NAT as one-to-one from a pool, and PAT as many-to-one using ports. Recognize PAT as the answer when the scenario says many hosts share a single public address. Expect port forwarding as the fix for an internal server that must accept inbound connections. And be ready to reject NAT as a security control when the question is really asking about filtering.