NAT & PAT

The problem: Too many devices, too few public addresses

Private IPv4 ranges (like 192.168.0.0/16 or 10.0.0.0/8) can be reused by literally every home and office network on earth, because they're never routed on the public internet. But a device using one of those addresses can't be reached from the internet directly. Something has to translate between the private address inside the network and a real, routable public address at the edge. That something is NAT (Network Address Translation).

It's exactly like an office building with one public street address, where every employee has their own internal extension. Mail addressed to the building's street address still needs a mailroom to figure out which specific desk it's actually for.

Static NAT, dynamic NAT, and PAT

• Static NAT: one private address always maps to the same one public address, a fixed, permanent mapping, typically for a server that needs to be reachable at a consistent public IP.
• Dynamic NAT: private addresses are mapped to public addresses from a shared pool, on a first-come basis, still one-to-one at any given moment, but not a fixed pairing.
• PAT (Port Address Translation, also called NAT overload): many private addresses share a single public address, distinguished from each other by port number. This is what almost every home and small-office router actually does.

How PAT keeps replies straight

Every outbound connection gets a unique combination of (public IP, public port) assigned to it, and the router keeps a translation table mapping that pair back to the original (private IP, private port) it came from. When a reply comes back addressed to that public IP and port, the router looks up the table and rewrites it back to the correct private device, exactly like a receptionist routing an incoming call to the right desk extension based on which line it came in on.