What Is NAT? Address Translation, Ports and CGNAT

NAT translates IP addresses as traffic crosses between networks. A familiar home use lets several devices share a public IPv4 address, but that is not its only form: one-to-one address mappings also exist.

Address translation and port translation

Basic NAT changes addresses. NAPT, often called PAT, can also translate TCP or UDP ports to distinguish flows sharing an outside address. SNAT describes source translation; DNAT describes destination translation. These terms describe different aspects rather than three mutually exclusive product types. RFC 3022 describes traditional NAT and NAPT.

These illustrative mappings use a documentation-only outside address:

192.168.1.20:51000 → 203.0.113.10:40001
192.168.1.21:51000 → 203.0.113.10:40002

The clients can choose the same local source port while the translator maintains separate outside mappings. Returning traffic is associated with the appropriate state. Capacity limits, timeouts or a translator restart can interrupt existing connections.

Why a forwarding rule may not make a service reachable

A port-forwarding rule might send outside TCP port 8443 to a particular internal address and port. The service must still listen on the correct interface, the destination address must remain stable, return routing must work and firewall policy must allow the flow. A UDP rule does not expose a TCP service simply because the port numbers match.

Check the service locally before testing from an authorized external connection. Connecting to the public address from inside the LAN may depend on NAT loopback support; it is not equivalent to a genuine outside test. Restrict management-service access rather than exposing it to every Internet source.

Double NAT is not necessarily under your control

Two home routers in sequence can create two translation layers. Provider-operated CGNAT adds a layer outside your router's administration. Creating a local forwarding rule does not create a matching provider-side mapping.

Compare the WAN address with the exit observed for the same IPv4 path. RFC 6598 reserves 100.64.0.0/10 as shared address space for CGN deployments. An address outside that range does not alone prove CGNAT is absent. Confirm public-address availability and inbound-connection policy with the provider.

Translation is not encryption or authentication

NAT does not encrypt payloads or verify users. A gateway can also enforce a stateful firewall policy, but that is a separate function. A network using globally addressed IPv6 still needs an intentional inbound-access policy; security should not be inferred solely from whether address translation exists.

For an unreachable service, establish whether it is listening, whether a local client can connect, which protocol is forwarded and whether another translation layer exists. Use the port and listener checks before recreating the same forwarding rule.