NAT (Network Address Translation) lets many devices with private IP addresses share one public IP address. Your router rewrites the source address and port of outgoing packets, remembers the mapping, and translates replies back to the right device.
How it works
The translation table
When your Mac (192.168.1.23:53621) connects to a server, the router replaces the source with its public address and a free port, say 203.0.113.7:40112, and records the mapping. When the reply arrives at port 40112, the router looks it up and forwards it to your Mac. Technically this is NAPT (port address translation), but everyone calls it NAT.
Side effects
- Incoming connections fail by default: an unsolicited packet arriving at the router matches no mapping, so it's dropped. That's why hosting a game server or reaching home from outside needs port forwarding.
- Mappings expire: idle UDP mappings may last only 30 seconds or so, which is why apps send keep-alives.
- Peer-to-peer is harder: calls and games use STUN, TURN and UPnP to get through.
NAT is not a firewall
It blocks unsolicited inbound traffic as a side effect, but it was designed to save IPv4 addresses. IPv6 networks usually don't use NAT and rely on a real firewall instead.
Double NAT and CGNAT
Two routers in a row, or an ISP doing its own carrier-grade NAT, add a second translation, which breaks port forwarding.
Examples
- Your Mac's address in System Settings is 192.168.1.23, but
curl -s https://api.ipify.orgshows 203.0.113.7: that's NAT. - Every device at home shows the same public IP to websites.
On a Mac
Compare ipconfig getifaddr en0 (your private address) with curl -s https://api.ipify.org (your public one). macOS can also act as a NAT router with Internet Sharing in System Settings › General › Sharing.
See it in the app
LightAtom's connections view shows the remote address and port of each connection; your router rewrites the local side on the way out.
Frequently asked questions
What does NAT do?
It lets several devices share one public IP address by translating private addresses and ports at the router.
Is NAT a security feature?
Partly by accident: it drops unsolicited incoming traffic. But it isn't a firewall, and you shouldn't rely on it as one.
What is NAT type in games?
Consoles rate how easily other players can connect to you. Strict or moderate NAT usually means double NAT or no UPnP or port forwarding.
Does IPv6 use NAT?
Normally no. There are enough IPv6 addresses for every device to have a public one, protected by a firewall.