· 4 min read
What is NAT, and what is CGNAT?
Network address translation is the reason your whole household can share one public IP address. It works well enough that most people never notice it, until they try to host something, or find that their ISP has put them behind a second layer of it.
On this page
What NAT does#
Network address translation rewrites the addresses in packets as they cross a router. The version almost everyone uses is called port address translation, or NAPT: many private devices share one public address, and the router tells their traffic apart by port number. It was introduced as a stopgap for the IPv4 shortage (RFC 3022) and became permanent infrastructure.
A translation, row by row#
Suppose the laptop at 192.168.1.10 opens a secure connection to a server at 198.51.100.7. The laptop picks a source port, say 51000. When the packet reaches the router, the router picks its own port, records the pairing, and sends the packet on with its public address as the sender.
| Source | Destination | |
|---|---|---|
| Leaves the laptop | 192.168.1.10:51000 | 198.51.100.7:443 |
| Router's table entry | 192.168.1.10:51000 ↔ 203.0.113.42:40001 | |
| Arrives at the server | 203.0.113.42:40001 | 198.51.100.7:443 |
| Server's reply | 198.51.100.7:443 | 203.0.113.42:40001 |
| Delivered to the laptop | 198.51.100.7:443 | 192.168.1.10:51000 |
The server only ever sees the public address. The private one is never on the wire outside the home.
The entry is created by an outbound packet and expires when the connection goes quiet. A packet arriving from outside with no matching entry has nowhere to go, and is dropped. This is why devices behind NAT are hard to reach from outside, and it is a side effect, not a design goal.
What NAT changes in practice#
- Inbound connections fail. To host a game server or a camera, you have to tell the router which port belongs to which device. That is a port forward.
- Some protocols need help. Voice and video calls, peer-to-peer transfers and online games have to discover their public address and punch holes through the table. They use helper protocols such as STUN and, for UDP, behaviour described in RFC 4787. When you see "NAT type: strict" in a game, this is what it means.
- Every device looks the same from outside. Websites cannot tell your laptop from your phone by address. They use other signals, such as cookies and fingerprints, to do that.
- Address reputation is shared. If someone else behind the same public address is abusive, everyone behind it inherits the block.
Carrier-grade NAT#
The same mechanism can be applied twice. When an ISP has too few public IPv4 addresses for all its customers, it puts carrier-grade NAT (CGNAT) in its own network, so hundreds or thousands of subscribers share one public address, and your home router translates once more inside that. Addresses in 100.64.0.0/10 are reserved for the link between the ISP and your router (RFC 6598). Mobile networks use CGNAT almost universally.
How to tell whether you are behind it
- Find the address on your router's Internet or WAN page. See how to find your IP address if you are not sure where.
- Compare it with the address on the home page.
- If they differ, and the router's address is in
100.64.0.0to100.127.255.255or is another private address, you are behind CGNAT or a second router.
What it costs you
- No inbound connections at all. Port forwarding cannot work, because the router that would have to forward is not yours.
- A shared reputation. You share an address with strangers, and a block aimed at one of them can catch you.
- Odd locations. The address belongs to the ISP's exit point, so the city shown by IP geolocation can be somewhere you have never been.
- Logging difficulty. An address on its own no longer identifies a subscriber. The ISP needs the port and the exact time as well.
Common questions#
Does NAT slow my connection?
The translation itself is negligible on home routers. CGNAT can add a hop and become a bottleneck at busy times, and it makes some services fall back to relayed connections, which are slower.
Do I need NAT with IPv6?
No. IPv6 has enough addresses for every device to have its own globally routable one. A router still blocks unsolicited inbound connections by default, so devices are not exposed simply because they are addressable.
What is double NAT?
Two routers each translating, for example an ISP-supplied box with your own router plugged into it. Everything on the inner network works for browsing and breaks for hosting. Put the ISP box in bridge mode, or plug your router's WAN port into a device that is only a modem.
Try it on your own connection
- Check your public IP addressSee the address every website sees, with the network and location behind it.
- Look up any IP address, domain or URLOwner, network, location estimate and risk flags for whatever you paste in.
- Test for IP, DNS and WebRTC leaksFind out whether a VPN is really hiding what you think it is.
Sources and further reading
Keep reading
- Addressing and routingPublic vs private IP addressesYour devices have a private address from your router and share one public address with the internet. The ranges, how NAT links them, and how to tell which is which.
- Addressing and routingIPv4 vs IPv6: what changedIPv4 has 4.3 billion addresses and IPv6 has 340 undecillion. How the two differ, how to read IPv6 notation, why both are in use, and what it means for your privacy.
- Addressing and routingStatic vs dynamic IP addressesA dynamic IP is leased and can change; a static IP stays put. How each works, when a static address is worth paying for, and how to tell which one you have.
- LocationCan an IP address reveal your location?No. IP geolocation is an estimate built from registry data and inference, often correct to the country and rarely to the street. How it works and why it goes wrong.
Published by My IP Address