Knowledge / network concepts

Network address translation

NAT. Rewrite addresses, and usually ports, at a boundary. Many inside, one outside. Not a firewall policy by itself.

Network address translation maps internal addresses to another space, typically a public IP, so return traffic finds the right socket. Port-level NAT is the usual many-to-one. It is why private-address hosts can reach the internet.

NAT is not access control. Having NAT does not mean inbound is closed; port forwards and IPv6 can still land on the host. Logs that only show the public IP hide which internal host talked. Dual-stack bypasses a v4-only story.

See also: CIDR, Firewall, VLAN.