CertCrack

November 1, 2026 · CertCrack Blog

What Is NAT? How One Public IP Address Serves a Whole Network

Search "what is my IP" on your phone, then on your laptop on the same Wi-Fi, and you will probably get the same answer. Yet each device has its own address on the home network, and both can browse at the same time. The trick that makes that possible is Network Address Translation, or NAT: the reason a whole household, office, or campus can share a single public internet address — and a topic that shows up on Network+, CCNA, and A+ exams again and again.

The address shortage that made NAT necessary

Every device that talks directly on the internet needs a public IP address, and there are only about 4.3 billion IPv4 addresses in existence. That sounded like plenty in the 1980s; it did not survive a world of smartphones, laptops, and smart TVs. The industry's first answer was to split addresses into two kinds: public addresses, unique and routable everywhere, and private addresses, reusable inside local networks and never routed on the public internet. The private ranges, set out in RFC 1918, are:

Your home router hands out addresses from one of these ranges — usually 192.168.x.x — using DHCP. That works inside the house, but a private address cannot be used on the public internet: if two homes both used 192.168.1.10, the internet could not tell them apart. Something at the edge of the network has to translate.

What the router actually does

That something is NAT, running on the router between your private network and the internet. When a device inside sends a packet out, the router rewrites the packet's source address, replacing the private address with its own public address. When the reply comes back, the router looks up which inside device it belongs to and rewrites the destination back to that private address before delivering it.

In the simplest form, static NAT, the mapping is one-to-one: one private address always translates to one public address. That suits a server that must always be reachable at the same public address, but it saves no addresses. Dynamic NAT uses a pool of public addresses handed out as needed — better, but a pool still runs out if there are more devices than public addresses.

PAT: the version running in your home

The form of NAT almost everyone actually uses is Port Address Translation, or PAT — also called NAT overload. With PAT, many private addresses share a single public address, and the router tells the conversations apart by port number.

Here is a simplified version of what happens. Your laptop (192.168.1.10) opens a web page from source port 49152. Your phone (192.168.1.11) opens a different page, also from port 49152. The router rewrites both packets to its public address, say 203.0.113.7, but gives them different outside source ports — 50001 for the laptop, 50002 for the phone — and records both mappings in a translation table. Replies to 203.0.113.7 on port 50001 go to the laptop; port 50002 goes to the phone. One public address, dozens of devices, no confusion — as long as the router keeps its table.

That table is also why PAT only works for conversations started from the inside. If someone on the internet tries to connect to your public address out of the blue, the router finds no matching entry and drops the packet. That behaviour looks a bit like a firewall, but say it plainly: NAT is not a firewall. It blocks unsolicited inbound connections as a side effect, not as a security design, and it does nothing to inspect traffic or stop malware a user downloads. Exams test that distinction, and so do interviewers.

Port forwarding: opening a deliberate door

Sometimes you do want an inbound connection: a game server, a security camera, or a remote-desktop session. Port forwarding is a static PAT entry you create by hand: "anything arriving on my public address on port 8080 goes to 192.168.1.20 on port 80." The router then has a table entry for traffic nobody inside started, and the connection works.

When a hosted game or camera "works locally but not from outside," check the forwarding rule first: the wrong inside address (DHCP moved the server — a reservation fixes that), the wrong port or protocol (TCP vs UDP), or the device's own software firewall.

When NAT is stacked: double NAT and CGNAT

Double NAT happens when two routers both perform NAT — for example, a provider's modem-router feeding your own router. Traffic is translated twice, and port forwarding must be configured on both boxes (or the first put into bridge mode) or inbound connections fail.

Carrier-grade NAT, or CGNAT, is NAT run by the internet provider itself. Many providers no longer have enough public addresses for every customer, so they put customers behind a second layer of NAT using the shared address space 100.64.0.0/10 (RFC 6598). If your router's "public" address starts with 100.64 to 100.127, you are behind CGNAT — and port forwarding on your own router alone will not make your server reachable from the internet, because the provider's NAT sits in front of it and you cannot configure it.

NAT and IPv6

IPv6 was designed with so many addresses that NAT's address-saving job is no longer needed: every device can have its own globally unique address. Transition mechanisms such as NAT64 still let IPv6-only networks reach IPv4-only services, but the long-term direction is a return to end-to-end addressing, with a real firewall — not address translation — providing the security boundary.

Exam connection

NAT appears across the certifications this site covers. A+ Core 1 (220-1201) expects you to recognise private address ranges and the home router's role. Network+ (N10-009) goes deeper: static vs dynamic NAT vs PAT, port forwarding, and double-NAT troubleshooting. CCNA (200-301) expects you to configure it — marking interfaces ip nat inside and ip nat outside, with overload the keyword that turns plain NAT into PAT. Security+ (SY0-701) tests the security angle: NAT hides internal addressing, but it is not a security control on its own.

Practical takeaway

Think of NAT as the reception desk of a large building: everyone inside has a room number (a private address), but all outgoing mail carries the building's street address (the public address), and the desk uses a logbook — the translation table, with port numbers as the extra detail — to route replies back to the right room. Port forwarding is a standing instruction: "deliveries for this department go straight to room 20." And if your router's outside address falls in 100.64.0.0/10, remember there is a second reception desk upstream that you do not control.

FAQ

Is NAT the same as a firewall?

No. NAT translates addresses; a firewall inspects and filters traffic against rules. NAT happens to drop unsolicited inbound packets because it has no table entry for them, but it will happily pass through malware, phishing pages, and anything else a user inside requests.

Why does my device's IP address differ from what "what is my IP" shows?

The address on your device is a private address on your local network. The website sees your router's public address, after NAT — which is why every device on the same Wi-Fi shows the same public address.

Does NAT slow down my connection?

On modern hardware, no, not noticeably. The router rewrites addresses and looks up its table quickly, and that work is tiny compared with the speed of the connection itself. If a connection is slow, look at bandwidth, Wi-Fi signal, or congestion before blaming NAT.



Ready to prove it?

Reading about IT is a start. CertCrack practice exams for A+ Core 1, Network+, CCNA, and Security+ test you the way the real exam does — with explanations for every answer.

Try a Free Sample Quiz