How Port Address Translation (PAT) Works

Introduction

IPv4 has approximately 4.3 billion addresses — far fewer than the number of internet-connected devices worldwide. Network Address Translation (NAT), and specifically its most common form Port Address Translation (PAT) (also called NAT overload), allows many devices on a private network to share a single public IP address. When your home router sends traffic to the internet, all your devices appear to use one IP — your router’s WAN IP. PAT achieves this by tracking which private device originated each connection using the TCP/UDP source port number.

Step-by-Step: How PAT Translates Packets

flowchart TD
    A["1. Private Network Topology"]
    B["2. Outbound Packet Translation"]
    C["3. Concurrent Connections (Port Multiplexing)"]
    D["4. Inbound Response Translation"]
    E["5. PAT Limitations and Hairpin NAT"]
    A --> B
    B --> C
    C --> D
    D --> E

Step 1: Private Network Topology

Home/Office Private Network (RFC 1918):
  Laptop:  192.168.1.10
  Phone:   192.168.1.11  
  Desktop: 192.168.1.12

Router WAN (Public IP):  203.0.113.1

All three devices share the single public IP 203.0.113.1.

Step 2: Outbound Packet Translation

When the laptop opens a TCP connection to 142.250.80.46:443 (Google):

Original packet (private):
  Src IP:   192.168.1.10    Src Port: 52341
  Dst IP:   142.250.80.46   Dst Port: 443

Router PAT translation:
  Src IP:   203.0.113.1     Src Port: 10001  ← NAT assigned port
  Dst IP:   142.250.80.46   Dst Port: 443

NAT table entry added:
  Private:         192.168.1.10:52341 ↔ Public: 203.0.113.1:10001

The router replaces the private source IP and port with the public IP and a NAT-assigned port number, then records the mapping in the NAT translation table.

Step 3: Concurrent Connections (Port Multiplexing)

All three devices can simultaneously connect to the same destination:

NAT Table:
Private Addr:Port        Public Addr:Port       Destination
192.168.1.10:52341  ↔  203.0.113.1:10001  →  142.250.80.46:443
192.168.1.11:48291  ↔  203.0.113.1:10002  →  142.250.80.46:443
192.168.1.12:61023  ↔  203.0.113.1:10003  →  142.250.80.46:443

The NAT port space is 65,535 ports per protocol — supporting thousands of concurrent connections from a single public IP.

Step 4: Inbound Response Translation

When Google responds to port 10001:

Inbound packet:
  Src IP:   142.250.80.46   Src Port: 443
  Dst IP:   203.0.113.1     Dst Port: 10001

Router looks up NAT table → finds 10001 maps to 192.168.1.10:52341

Translated to:
  Src IP:   142.250.80.46   Src Port: 443
  Dst IP:   192.168.1.10    Dst Port: 52341  ← Original private endpoint

Delivered to laptop

Step 5: PAT Limitations and Hairpin NAT

Inbound connections are impossible without port forwarding — an external host can’t reach 192.168.1.10:8080 because there’s no NAT table entry to translate to.

Port forwarding creates static entries:

Static NAT rule: 203.0.113.1:8080 → 192.168.1.10:8080

Hairpin NAT (NAT loopback) allows devices on the private network to reach other private devices via the public IP — the router translates the traffic back internally instead of routing it to the internet.

# View Linux iptables NAT rules (Linux router)
iptables -t nat -L POSTROUTING -v -n

# NAT masquerade (PAT) — all outbound traffic from LAN appears as router IP
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

Key Takeaways

• PAT maps many private IP:port pairs to one public IP using different source port numbers — supporting ~65,000 concurrent connections per public IP.
• The NAT translation table is stateful — it records the private-to-public port mapping and uses it to translate inbound responses.
• PAT is stateful and session-based — connections initiated from outside the private network are blocked unless a port forwarding rule exists.
• Port exhaustion (all 65,535 ports in use) can occur on NAT gateways with millions of concurrent connections — cloud NAT Gateways mitigate this with multiple public IPs.
• AWS NAT Gateway uses PAT internally and automatically allocates multiple Elastic IPs for high-connection-count workloads.