NAT and PAT

Twenty people at Kite Studio browse at once, from private addresses the internet will not carry, through one public address, 203.0.113.10. Replies come back and land on the right laptop every time. The router is keeping a translation notebook, and the way it keeps it has names: NAT and PAT.

The rule

NAT swaps addresses at the border; PAT adds ports so many can share one.

NAT (Network Address Translation) runs on the border router. As a packet leaves, the router rewrites its private source address to a public one and notes the swap; when the reply arrives, it reverses the rewrite. Variants:

• Static NAT — a permanent one-to-one pairing. The studio could map files (192.168.10.20) to a dedicated public address so outsiders can always reach it. One public address per inside host.
• Dynamic NAT — the router takes a public address from a pool while an inside host needs one, and returns it afterwards. Still one-to-one at any moment, so the pool must be as large as the number of hosts online together.

PAT (Port Address Translation), also called NAT overload, is what almost every office and home actually runs. Many inside hosts share one public address; the router tells their conversations apart by giving each one its own public-side port number:

Both laptops happened to pick the same source port, but the router gave them different outside ports, so the replies are never confused.

NAT64 solves a different problem: it lets devices on an IPv6-only network reach IPv4-only servers, translating between the two protocols at the border (usually paired with DNS64, which invents IPv6 addresses for IPv4-only names).

Side effect to remember: because the translation entry is created by outgoing traffic, an outsider cannot start a connection to an inside host through PAT unless a port forward (a static entry) is configured.

The shortcut

Ask "How many inside hosts per public address?" Exactly one, forever → static NAT. One at a time from a pool → dynamic NAT. Many at once → PAT. Different IP versions on each side → NAT64.

Drills

Answer fast — trust the rule.

Remember

• NAT swaps addresses at the border; PAT adds ports so many can share one.
• One-to-one forever = static; one-to-one from a pool = dynamic; many-to-one = PAT; v6-to-v4 = NAT64.
• Outsiders cannot start connections through PAT unless you add a port forward.