Network

What is NAT?

Network Address Translation rewrites the address and port fields of packets as they cross a router, letting many private hosts share one public IP. The router keeps a translation table, mapping each outbound flow to a free public port and reversing the rewrite on replies. Home routers do this for a household; carriers do it for whole regions.

The common form is NAPT, which translates ports as well as addresses. When a host on 192.168.1.0/24 opens a connection, the router swaps the private source address for its public one and the source port for a free port of its own, then records the mapping in a state table keyed on addresses, ports and protocol. Replies are matched against that table and rewritten back. Nothing outside learns the internal address, which is a side effect of the mechanism rather than its purpose.

Those table entries expire. A mapping for an established TCP connection is normally held through a long idle period, while UDP mappings are dropped after seconds to a few minutes, since there is no connection state for the router to watch. A long-lived session that goes quiet loses its mapping, and the next packet reaches a translator that no longer knows where to send it. Keepalives exist for this reason, and tuning their interval below the shortest timeout on the path is what makes idle sessions survive.

Translators do not all behave alike. Some reuse a single external port for a given internal socket no matter where traffic is headed, which lets an outside peer send to that port; others allocate a fresh port per destination, which makes unsolicited inbound impossible. WebRTC and VoIP work around this with STUN to discover the external mapping, TURN to relay when discovery fails, and ICE to pick among candidates. That discovery step is also how a browser can disclose addresses a proxy was supposed to hide.

If you host a proxy yourself, NAT decides whether anyone can reach it. A listener on a private address needs a forwarded port on the router and an internal address that DHCP will not move - or a backconnect design, where the proxy dials out to a gateway and clients connect to the gateway instead. Providers running mobile devices behind carrier translation have no choice but the second approach, since they cannot forward a port they do not control.

Where you meet it

NAT explains a class of problems that look like proxy faults. A SOCKS5 UDP session dies after a quiet minute because the mapping expired, and a self-hosted proxy that answers fine on the LAN times out from outside. A WebRTC test prints a local 192.168 address beside the proxy's public one. In each case the translator is behaving normally, so check the mapping and its timeout before rewriting client code.

Common questions

Is NAT the same as a firewall?

No. A translator discards unsolicited inbound packets because it holds no mapping for them, which resembles filtering, but it applies no policy and inspects nothing your hosts initiate. Run a real firewall alongside it, since plenty of attacks arrive over connections opened from inside the network.

What is the difference between NAT and CGNAT?

Scale and ownership. NAT usually runs in your own router, translating a handful of devices onto the single public address your ISP assigned. CGNAT runs inside the carrier network and places many separate customers behind one address, so you control neither the outermost translation nor any port forwarding through it.

Why does NAT break peer-to-peer connections?

Neither side can address the other directly, because both hold private addresses and only outbound flows create mappings. Applications work around it by discovering their external mapping with STUN and punching a hole with simultaneous outbound packets. When the translator assigns a different port per destination, that fails and the traffic has to go through a TURN relay.

Related terms

CGNAT
Carrier-grade NAT is address translation performed by an ISP rather than in the customer's router, putting many subscribers behind one public IPv4 address. Mobile networks depend on it. Each customer holds a private or shared-range address, usually from 100.64.0.0/10, and the carrier rewrites the source address and port on every outbound flow.
IP Address
An IP address is the numeric identifier a device presents on an IP network so packets can be routed to and from it. IPv4 writes 32 bits as four decimal octets, such as 203.0.113.7. IPv6 writes 128 bits as hexadecimal groups, such as 2001:db8::1. Every request a server logs is tied to one.
IPv4
IPv4 is version 4 of the Internet Protocol, addressing hosts with 32 bits written as four dot-separated octets, which gives roughly 4.3 billion addresses. The top-level pool ran dry in 2011, pushing providers toward private addressing, carrier-grade NAT and a paid transfer market. Nearly all proxy traffic still runs over IPv4 because that is what target sites accept.
IPv6
IPv6 is version 6 of the Internet Protocol, addressing hosts with 128 bits written as eight hexadecimal groups, such as 2001:db8::1. The space is large enough that carriers assign each subscriber a whole subnet, usually a /64 or wider, so reputation systems score prefixes instead of single addresses. Adoption is broad but far from universal.
ASN
An Autonomous System Number identifies a network that announces its own IP address ranges to the rest of the internet through BGP. Every routable address sits inside a prefix announced by some AS, so the ASN behind an IP tells you who operates it - a mobile carrier, a hosting provider, a home ISP or a corporate network.
DNS
The Domain Name System turns a hostname such as example.com into the IP addresses a client can connect to. A stub resolver on the device asks a recursive resolver, which walks the root, TLD and authoritative name servers, then caches the answer for the record's TTL. Queries travel on port 53, or over TLS or HTTPS when encrypted.
DNS Leak
A DNS leak happens when a client sends its name lookups outside the proxy tunnel, so queries travel over the real ISP connection while the traffic itself exits on the proxy IP. The resolver operator, and any authoritative server it contacts, then sees a lookup tied to your actual network, region and provider.
WebRTC Leak
A WebRTC leak is a browser exposing your real IP address through its peer-to-peer connection API while page traffic goes through a proxy. WebRTC gathers ICE candidates over its own UDP sockets, which ignore the browser's proxy configuration, and any script on the page can read those candidates without asking permission.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary