What Is NAT, and Does It Provide Security?
NAT (Network Address Translation) lets many devices on a private network share a single public IP address, by rewriting address and port information at the router. It exists mainly to stretch the scarce supply of IPv4 addresses — and it is one of the most commonly misunderstood pieces of networking, routinely mistaken for a security control it is not.
What does NAT actually do?#
When an internal device connects out, the NAT router rewrites the packet’s private source address to the shared public one (and tracks the mapping to route replies back). Dozens or thousands of internal devices thus appear to the internet as one address. It solves an addressing problem, not a security one.
Where does the “NAT is a firewall” myth come from?#
From a genuine side effect: because NAT has no mapping for unsolicited inbound connections, it drops them by default — which looks like a firewall blocking inbound traffic.
| NAT does | NAT does not |
|---|---|
| Block unsolicited inbound (incidentally) | Filter outbound traffic |
| Hide internal addressing | Inspect content or enforce policy |
| Conserve IPv4 addresses | Provide logging or intent-based rules |
That incidental inbound-blocking is real but shallow. NAT does nothing about outbound connections (so a reverse shell sails right out), inspects no content, and enforces no policy.
NAT is addressing infrastructure often confused with defense. More at the Network Security hub.
Frequently asked questions#
What does NAT do?
Network Address Translation (NAT) lets multiple devices on a private network share a single public IP address by rewriting address and port information as traffic passes the router. It was created to conserve scarce IPv4 addresses, allowing large internal networks to reach the internet through one or a few public addresses.
Does NAT act as a firewall?
Not really, though it is often mistaken for one. NAT incidentally blocks unsolicited inbound connections because it has no mapping for them, which looks firewall-like. But it does not filter outbound traffic, inspect content, or enforce policy, and its "protection" is a side effect. Rely on an actual firewall, not NAT, for security.