Network Address Translation (NAT) is a method of mapping IP addresses from one group to another, so devices using private addresses can reach the internet through a public address. A variant called Network Address Port Translation (NAPT) also translates TCP and UDP ports, which lets many internal devices share a single public IP. Websites see that shared public address, not the device behind it.

NAT also conserves IPv4 addresses. Private addresses are only valid inside their own network, so the same private ranges can be reused in many separate networks.

Private Address Ranges

RFC 1918 reserves three IPv4 ranges for private networks that NAT translates:

  • 10.0.0.0 to 10.255.255.255 (10/8)
  • 172.16.0.0 to 172.31.255.255 (172.16/12)
  • 192.168.0.0 to 192.168.255.255 (192.168/16)

Carrier-Grade NAT (CGN)

Carrier-grade NAT is NAT run inside an internet service provider's network to share one public IPv4 address among several subscribers. ISPs deploy it in response to IPv4 address scarcity. The IETF set aside 100.64.0.0/10 as Shared Address Space for the addresses between subscribers and the CGN.

Why NAT Matters for IP Blocking and Geolocation

  • Shared blocks: When many users share one address, blocking that address restricts all of them, not just the one who caused the block.
  • Location: A user behind a CGN geolocates to wherever the CGN's address prefix appears to be, which can be far from the user's real location.
  • Attribution: Behind a CGN, an IPv4 address alone no longer identifies a single subscriber. Source ports and accurate timestamps are needed as well.

Types of NAT

  • Static NAT: Each private address maps one-to-one to a fixed public address.
  • Dynamic NAT: Public addresses are assigned to private hosts as needed and released when the host's last session ends.
  • Basic NAT: Translates only addresses, using a block of public addresses set aside for private hosts.
  • Twice NAT: Changes both the source and destination addresses, typically when private and public address spaces overlap.

NAT Limitations

  • Inbound connections: Traditional NAT allows sessions only outbound from the private network. An outside host cannot start a session with a device behind it.
  • Embedded addresses: Applications that carry IP addresses or ports inside the payload need an application level gateway (ALG) to work through NAT.
  • End-to-end IPsec: IPsec that protects a packet's endpoint addresses does not work with NAT in the path for most applications.