Translating addresses alone still costs one public IP per device. Adding port numbers is what lets hundreds of them share just one.
"NAT" gets used as a catch-all term for how a router lets a private network reach the internet, but the router in your office or your home almost certainly isn't running the mechanism the name literally describes. Basic Network Address Translation — one private IP rewritten to one public IP — still needs roughly as many public addresses as it has devices. The thing that actually lets an entire building share a single public IP is a more specific mechanism, Port Address Translation, and the difference between the two is not just naming trivia — it's the whole reason IPv4 hasn't run out for home and office networks the way the raw math of a 32-bit address space would suggest it should have.
Every device on a private network (192.168.x.x, 10.x.x.x, and similar RFC 1918 ranges) has an address that means nothing outside that network — it isn't globally routable, and the internet has no idea how to send a reply to it. When a packet from one of those devices needs to leave the network, the router sitting at the edge rewrites the packet's source address to one that is globally routable, then keeps a record so it can undo that rewrite on the way back. Exactly how much bookkeeping the router does — and how many internal devices can share how many public addresses while doing it — depends entirely on which of the two mechanisms below it's running.
Basic one-to-one NAT only has one thing to rewrite: the address. Run out of unique addresses to hand out and you run out of translation capacity — full stop. PAT adds a second field to the rewrite: the source port. Since a single public IP address carries 65,536possible port numbers, the router can hand out a different external port to every simultaneous connection from every internal device, and keep a table recording which internal (IP, port) pair each external port belongs to. Return traffic arrives addressed to the shared public IP at one specific port, the router looks up that port in its table, and rewrites the packet back to the correct internal device. That table lookup is what makes an entire office of devices, all sharing one public IP, indistinguishable from the internet's point of view — and completely distinguishable from the router's.
Not quite — and the confusion is understandable, because in casual conversation "NAT" is almost always used to mean what's technically PAT, since PAT is by far the more common real-world deployment. But the mechanisms genuinely differ. Basic NAT (one-to-one) translates only the IP address and still requires roughly one public IP per internal device — at real-world office or ISP scale, that doesn't meaningfully solve IPv4 address scarcity at all. PAT (NAT overload) additionally tracks and rewrites the port numberof every connection, which is the specific thing that lets many internal devices share one public IP simultaneously. "NAT" being used loosely for PAT is harmless in casual conversation, but it breaks down the moment you need to understand port forwarding (routing one external port to one specific internal device) or NAT traversal problems for certain applications — both of which only make sense once you're thinking in terms of the port-based translation table PAT actually keeps, not simple address-to-address NAT.
Explains the difference between basic Network Address Translation (NAT), which maps one internal private IP address to one external public IP address, and Port Address Translation (PAT, also called NAT overload), which maps many internal private IP addresses to a single public IP address by additionally tracking connection port numbers — and why only the port-based version actually solves the real-world IPv4 address-scarcity problem.
In its basic form, NAT translates exactly one internal private IP address to one external public IP address, giving each device that needs external access its own dedicated mapping. This requires having enough public IP addresses available for a true one-to-one match — if 40 internal devices need external access, basic NAT needs 40 public IP addresses. It works, and it's simple to reason about, but it doesn't reduce public IP consumption at all; it just relocates which addresses are public versus private. At real-world scale, needing roughly one public IP per device is exactly the problem IPv4 exhaustion created in the first place.
PAT is the mechanism actually running on the overwhelming majority of home routers and office edge devices. It translates many internal private IP addresses down to a single public IP address by additionally rewriting the source port number of each connection. Because one public IP address has 65,536 possible port numbers (0–65535), the router can assign a distinct external port to every simultaneous connection from every internal device — even if two internal devices happen to use the identical local port number — and record each mapping in a translation table: internal (IP, port) to external (IP, port). When a reply arrives at the shared public IP on a specific port, the router looks up that port in its table and routes the packet back to the correct internal device.
Basic one-to-one NAT translates addresses without needing to track port numbers, and still costs roughly one public IP per device — it doesn't meaningfully help with real-world IPv4 scarcity at office or ISP scale. PAT specifically uses the port number as an additional, essentially free dimension to multiplex many internal devices onto one public IP address. That is exactly why a home network with a dozen devices, or an office with hundreds of workstations, can all share internet access through a single public IP handed out by an ISP. In casual conversation "NAT" is often used loosely to mean PAT, since PAT is the far more common real-world deployment — but the underlying mechanisms genuinely differ, and only the port-based one is doing the address-conservation work.
Port forwarding — opening a specific external port so inbound traffic routes to one particular internal device and port — only makes sense once you're thinking in terms of PAT's translation table, since it's manually adding a static entry to a table that would otherwise be built dynamically from outbound connections. Similarly, NAT traversal challenges for certain applications (peer-to-peer connections, some VoIP and gaming protocols) exist specifically because an unsolicited inbound packet has no outbound connection already in the PAT table to match against, so the router has nowhere to route it. Both concepts are unavoidably about port-based translation, not simple address-only NAT.
PAT is a specific type of NAT — sometimes called NAT overload — that adds port-number translation on top of address translation. All PAT is NAT, but not all NAT is PAT; basic one-to-one NAT translates addresses only, with no port involved.
Because the router runs PAT, not basic one-to-one NAT. A single public IP combined with 65,536 available ports gives the router more than enough capacity to track every simultaneous connection from every device on the home network, so the ISP only needs to hand out one public address per subscriber.
It doesn't matter. PAT's translation table is keyed on the combination of internal IP and port mapped to a chosen external port, and the router is free to assign whichever external port is available — it doesn't need internal port numbers to be unique in the first place, since the external side is what has to stay unambiguous.
Yes, conceptually. Port forwarding is a manually configured, static entry added to what is otherwise the same kind of translation table PAT builds dynamically for outbound connections — it tells the router that inbound traffic to a specific external port should always route to a specific internal IP and port, bypassing the need for an existing outbound connection to match against.
Yes, though it's far less common for general internet access — it shows up where a specific internal server needs a permanent, dedicated public IP (rather than a forwarded port on a shared one), such as certain server hosting or site-to-site VPN configurations where address-level, not port-level, translation is required.
Try our Enterprise IT Networks Studio
More calculators, simulators, and guides for this discipline.