NAT (Network Address Translation) lets many devices with private IP addresses share one public IP, and lets a gateway redirect incoming traffic to internal machines. It’s the reason your home network works with a single IPv4 address, the reason home servers need port forwarding, and the reason a VPS with its own public IP is so convenient for hosting.
Why NAT exists
IPv4 has about 4.3 billion addresses, far fewer than the devices that need them. Private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are reused in every home and office. They aren’t routable on the internet, so a gateway translates them to a public address on the way out. See private IP ranges.
How it works
A laptop (192.168.1.20) opens a connection to a website:
- The packet leaves with source
192.168.1.20:51000. - The router replaces the source with its public IP and a port:
198.51.100.7:40001. It records the mapping in its connection tracking table. - The website replies to
198.51.100.7:40001. - The router looks up the mapping, rewrites the destination back to
192.168.1.20:51000, and forwards it inside.
Outbound connections “just work”. Unsolicited inbound connections don’t, because the router has no mapping that says which inside device should get them. That’s why hosting from behind NAT needs extra steps.
Types of NAT
| Type | Rewrites | Typical use |
|---|---|---|
| SNAT / masquerade | Source address (outbound) | Home and office routers, VPN gateways, containers reaching the internet |
| DNAT / port forwarding | Destination address (inbound) | Publishing an internal server on the gateway’s public IP |
| PAT / NAPT | Address plus port (many-to-one) | The common form of SNAT |
| 1:1 NAT | One public IP to one private IP | Cloud “elastic IPs”, some data centres |
CGNAT: NAT on top of NAT
Many ISPs, mobile networks especially, run out of IPv4 addresses and put customers behind carrier-grade NAT: your router gets an address from 100.64.0.0/10 (shared address space), and the ISP translates again to a public IP shared with many other customers.
Consequences:
- No port forwarding possible. You don’t control the outer NAT.
- Hosting from home, game servers, remote access and some VPNs and P2P apps break or degrade.
- IP-based reputation and rate limits are shared with strangers.
Check it: if your router’s WAN IP is in 100.64.0.0/10 (or another private range), or differs from curl -s ifconfig.me, you’re behind CGNAT.
Workarounds: IPv6 (if the ISP provides it), an outbound tunnel to a VPS with a public IP (frp, WireGuard, Cloudflare Tunnel), or simply hosting the service on a VPS.
NAT on a Linux server
Linux implements NAT in netfilter (iptables or nftables) with connection tracking. Common server uses:
A VPN gateway, so clients browse through the VPS:
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-forward.conf && sudo sysctl --system
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADEContainers and VMs: Docker masquerades container traffic so containers can reach the internet, and DNATs published ports. See Docker networking.
Forwarding a port to an internal host: DNAT plus masquerade. See port forwarding explained.
Connection tracking limits
Every NATed or tracked connection uses a conntrack entry. Busy gateways, or servers under attack, can fill the table:
sudo sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max
sudo dmesg | grep -i 'conntrack: table full'Raise nf_conntrack_max if needed. See sysctl tuning.
NAT and protocols
Some protocols embed IP addresses or need inbound connections, and need helpers or workarounds behind NAT: FTP (active mode), SIP/VoIP, some games, and P2P. Techniques like STUN/TURN (WebRTC) and UDP hole punching (Tailscale, games) let two NATed peers connect directly.
IPv6: NAT mostly unnecessary
IPv6 has enough addresses for every device to get a global address. Firewalls, not NAT, control inbound access. Running services over IPv6 avoids NAT and CGNAT problems entirely, if your users and ISP support it. See IPv4 vs IPv6.
Why a VPS sidesteps all of this
A VPS has a public IPv4 address directly on its interface. There’s no NAT between it and the internet, so any port you open in its firewall is reachable immediately. That’s why running websites, game servers, VPN endpoints and mail on a VPS is much simpler than hosting at home. See what is a VPS.
Quick reference
| Term | Meaning |
|---|---|
| SNAT / masquerade | Rewrite the source on the way out |
| DNAT | Rewrite the destination on the way in (port forwarding) |
| Conntrack | The table of active translations |
| CGNAT | ISP-level NAT, 100.64.0.0/10 |
ip_forward=1 |
Required for Linux to route or NAT between interfaces |
Related: private IP ranges and subnetting and CIDR.