Intuition The ONE core ideaEvery device that wants to talk on the internet needs an address and a door number (port) — but the world ran out of unique addresses, so many devices behind one router share a single public address and are told apart by their door numbers. NAT is just the router quietly rewriting the address-and-door labels on each packet, and keeping a notebook so replies find their way home.
Before you can understand why NAT exists or how SNAT/DNAT/PAT differ , you must own a handful of building blocks. This page defines every one of them from zero — no prior networking assumed. We build them in the exact order the parent note secretly relies on.
A packet is a small chunk of data the internet moves around. Think of it as an envelope : it has an address label on the outside (the header ) and a letter inside (the payload ).
The internet never sends your whole video or webpage in one piece. It chops the data into many envelopes, each labelled with where it's from and where it's going.
Look at the figure. The header is the outside of the envelope — the part routers read and can rewrite . The payload is sealed inside — normally untouched. Remember this split: NAT edits the header, and that is exactly why some protocols (which hide addresses inside the payload) break under NAT.
Why the topic needs this: NAT is defined as "rewriting header fields." You cannot understand rewriting until you know a packet has a header separate from a payload .
An IP address is the number that identifies one network location , like a house's street address. In IPv4 it is written as four numbers 0 255 192.168.0.10
Why four numbers each 0 255 8 bits . A bit is a single 0 1 8 byte , and a byte can count from 0 2 8 − 1 = 255 4 × 8 = 32
Why this exponent matters: 2 32 entire supply of addresses — and there are far more phones, laptops, and gadgets than that. That shortage is the WHOLE reason NAT was invented.
Worked example Reading an exponent2 8 = 256 2 16 = 65 , 536 2 24 = 16 , 777 , 216 8 256
Definition Prefix length (the/n)
The ==/n== after an address (as in 10.0.0.0/8 "the first n The free bits are called host bits .
Since an IPv4 address has 32 n 32 − n
In the figure, the left (fixed) part is the neighbourhood name — every house in the block shares it. The right (free) part is the individual house number. A smaller /n fixes fewer bits, so it leaves a bigger range of houses. That is why /8 is a huge block and /16 a modest one.
Why the topic needs this: the three private ranges the parent lists (10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 /n you can't see why one is bigger than another. See IPv4 Addressing & Subnetting for the deeper prefix math.
Definition Public vs private IPA public IP is globally unique and reachable from anywhere on the internet — like a real postal address. A private IP (from the RFC 1918 ranges) is only meaningful inside your local network and is never routed on the public internet.
Every apartment building can have an "Apartment 3B" — that label only means something inside that building. Private IPs are the same: millions of homes all use 192.168.0.10 never leave the building . The router swaps them for the building's single public address on the way out.
Why the topic needs this: "many private devices share few public addresses" is the entire job of NAT. This distinction is the hinge. See RFC 1918 Private Addresses .
A port is a number from 0 65535 which conversation on a device a packet belongs to. If the IP address gets the envelope to the right building, the port gets it to the right room / app inside.
Why 0 65535 16 bits , and 2 16 = 65536 0 65535
One laptop can browse two sites at once because each browser tab uses a different source port . The IP says "this laptop"; the port says "this tab ." Look at the figure: same address, several doors.
Why the topic needs this: PAT ("Port Address Translation") works by rewriting ports so that many hosts sharing one public IP stay distinguishable. No ports, no PAT. See Ports & TCP-UDP Headers .
Every connection is identified by four values written together. The parent note writes them as:
( src IP , src port , dst IP , dst port )
Definition Reading the tuple
src IP / src port = who sent it (source building + source door).dst IP / dst port = who it's going to (destination building + destination door).The parentheses-with-commas is just a tuple : an ordered group of values treated as one label. The order is fixed, so position tells you which is which.
Think of the tuple as the full mailing line: "From: House 5, Room 40001 — To: House 99, Room 80." Change the "From" part and you have SNAT; change the "To" part and you have DNAT; change the "From" address and door together and you have PAT.
Why the topic needs this: SNAT, DNAT, and PAT are defined by which entries of this tuple they rewrite . It is the coordinate system of the whole topic.
Definition Translation tableA translation table is the list the router keeps, matching every outgoing rewrite to its original, so it can reverse the rewrite when a reply comes back.
The figure shows one row: original inside label ⟷ rewritten outside label . When a reply arrives addressed to the rewritten label, the router reads the row right-to-left and restores the original. Without this notebook, replies could never find the right internal device.
Why the topic needs this: "keeps a translation table so it can reverse the rewrite" is the mechanical heart of how NAT is reversible. Everything else is bookkeeping around this table.
A checksum is a small number computed from the header's contents. The receiver recomputes it; if it doesn't match, the packet was corrupted.
It is like adding up the digits of a form and writing the total in a corner. Change any field and the total changes. So when NAT rewrites an IP or port, the old total is now wrong — NAT must recompute the checksum, or the packet gets thrown away as "damaged."
Why the topic needs this: the parent says NAT "recomputes the affected checksums." This is why: rewriting a field breaks the old checksum.
Bits and bytes 8 bits = one number 0-255
Port 16 bits number 0-65535
Exponents 2^32 total addresses
Address shortage motivates NAT
Slash notation /n fixes first n bits
Packet = header + payload
The 4-tuple src IP src port dst IP dst port
Translation table reverses rewrites
Checksum must be recomputed
NAT and its types SNAT DNAT PAT
Test yourself — each should be an instant, confident answer before you read the main NAT note.
What is the difference between a packet's header and its payload? The header is the outside label routers read/rewrite; the payload is the sealed data inside, normally untouched.
How many bits is an IPv4 address, and how many total addresses does that give? 32 bits, giving 2 32 ≈ 4.3
Why can each of the four numbers in an IP only go up to 255? Each is stored in 8 bits, and 2 8 − 1 = 255
What does the /n in 10.0.0.0/8 The first n 32 − n
How many addresses are in a /16 block? 2 32 − 16 = 2 16 = 65 , 536
Why can millions of homes all use 192.168.0.10 Private IPs are never routed on the public internet; the router swaps them for a public IP before packets leave.
What is a port and how many are there? A 16-bit number (0 65535 2 16 = 65536
Name the four fields in the connection tuple. src IP, src port, dst IP, dst port.
What does the translation table let the router do? Reverse each outbound rewrite so replies reach the correct internal device.
Why must NAT recompute the checksum after rewriting a field? The checksum is computed from the header contents; changing a field makes the old value wrong, so the packet would be discarded as corrupted.
NAT — Hinglish parent note IPv4 Addressing & Subnetting — the /n prefix and host-bit mathRFC 1918 Private Addresses — the three private rangesPorts & TCP-UDP Headers — where ports live in the headerFirewalls vs NAT — why NAT is not securitySTUN, TURN & NAT Traversal — when the payload hides addressesIPv6 — the bigger address space that eases the shortagePort Forwarding & DMZ — DNAT in practice 
