Private addresses can’t traverse the internet, so NAT rewrites them into public ones. PAT lets a whole network share a single public IP — the reason IPv4 still works.
Why: there are far fewer public IPv4 addresses than devices, so networks use private RFC 1918 addresses internally and NAT translates them to a public address at the edge — without it, private hosts could not reach the internet. When: NAT runs on the router/firewall at the network boundary. Where: it also hides internal addressing, adding a layer of obscurity.
INSIDE (private) OUTSIDE (public internet)
192.168.1.10 --------[ NAT ]--------> 203.0.113.5
The router rewrites the source IP as the packet leaves, and reverses
the translation on the reply. The internet only ever sees 203.0.113.5.Why: there are three flavors — static (one fixed private↔public mapping, e.g. for a server), dynamic (a pool of public IPs shared as needed), and PAT/overload (many private hosts share ONE public IP, distinguished by port) — and PAT is what home and most business networks use. When: static for inbound servers, PAT for outbound internet access. Where: PAT is why thousands of devices can share a single public address.
STATIC NAT 192.168.1.10 <-> 203.0.113.5 (1:1, permanent)
DYNAMIC NAT inside hosts <-> pool of public IPs (1:1, temporary)
PAT/OVERLOAD many hosts <-> ONE public IP + unique source PORT
PAT example (the router tracks the port to reverse it):
192.168.1.10:51000 -> 203.0.113.5:51000
192.168.1.11:51000 -> 203.0.113.5:51001Why: the most common real config is PAT (overload) so an entire LAN reaches the internet through one public interface — seeing the actual commands makes NAT concrete. When: mark the inside and outside interfaces, define which private addresses to translate with an ACL, then overload onto the outside interface. Where: verify with show ip nat translations to watch the mappings appear.
! Mark which interfaces are inside and outside
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
! Translate the private LAN, overloaded onto the outside interface (PAT)
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
! Verify:
! show ip nat translations
! show ip nat statistics