NAT overload, PAT explained with config

why your whole office hides behind one ip address

ever wonder how 50 laptops in an office all get online with just one public ip from the isp? that's nat overload doing the heavy lifting. also called pat (port address translation), it's the reason your private lan addresses like 192.168.1.x can talk to the internet even though those addresses are completely unroutable out there. today we're breaking down how it works and why understanding it matters if you're the one defending that network.

the problem it solves

private ip ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) were never meant to touch the public internet. they're reserved for internal use, which means routers on the internet will just drop packets from them. so how does your laptop reach google? your router rewrites the source address before the packet leaves your network, swapping your private ip for the router's public one.

the "overload" part is what makes this scale. instead of needing one public ip per device (which we straight up don't have enough of anymore, thanks ipv4), overload lets hundreds of internal devices share a single public ip by tracking everything through port numbers.

the config, broken down

on a cisco router this usually looks something like:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/1
 ip address 203.0.113.5 255.255.255.0
 ip nat outside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface GigabitEthernet0/1 overload

here's what each piece is actually doing:

ip nat inside / ip nat outside tells the router which interface faces your private network and which one faces the internet. the router needs this distinction to know which direction traffic is coming from before it decides to translate anything.

access-list 1 defines which internal addresses are even allowed to be translated. this is also a quiet security control, if a subnet isn't in this acl, it doesn't get out. that's worth remembering later.

ip nat inside source list 1 interface Gi0/1 overload is the command that ties it together. it says "take anything matching acl 1, rewrite it using the ip on Gi0/1, and use overload" meaning many-to-one translation using ports instead of a 1-to-1 ip swap.

the part that actually makes it work: ports

without overload, nat would need one public ip per internal device, which defeats the purpose. overload solves this by tracking connections using the port number instead of just the ip. so when three different internal machines all reach out to the same website, the router keeps them straight like this:

192.168.1.10:5000 -> 203.0.113.5:40001
192.168.1.11:5001 -> 203.0.113.5:40002
192.168.1.12:5002 -> 203.0.113.5:40003

same public ip, different port for each session. when a reply comes back, the router checks its translation table, matches the port to the right internal device, and forwards it. that table is temporary and gets cleaned up once the connection ends.

checking your own translation table

if you manage this kind of router, this is the command that shows you what's actually happening right now:

show ip nat translations

this lists every active translation, the inside private address and port, the inside global (public-facing) address and port, and what it's talking to outside. this is genuinely useful for defenders, not just for learning nat. if you see translations to destinations you don't recognize, or way more active sessions than expected from a single host, that's a signal something on your network might be phoning home somewhere it shouldn't.

the takeaway

nat overload isn't just a networking party trick, it's also a light layer of protection since internal addresses are never directly exposed to the internet. but it's not a firewall and it's not a substitute for one. if you're running this on your own gear, tighten that access-list to only the subnets that need to leave, keep an eye on show ip nat translations for anything weird, and pair nat with actual stateful filtering. one public ip hiding your whole network is convenient, just don't mistake convenience for security.