Network address translation
NAT. Rewrite addresses, and usually ports, at a boundary. Many inside, one outside. Not a firewall policy by itself.
Network address translation maps internal addresses to another space, typically a public IP, so return traffic finds the right socket. Port-level NAT is the usual many-to-one. It is why private-address hosts can reach the internet.
NAT is not access control. Having NAT does not mean inbound is closed; port forwards and IPv6 can still land on the host. Logs that only show the public IP hide which internal host talked. Dual-stack bypasses a v4-only story.
