1.8 NAT (Network Address Translation)

By Ravindra Bagale Last updated: 30 September 2026

Students in my class always ask: "Sir, my laptop shows 192.168.1.5, but Google sees a different IP. Why?" The answer is NAT. Come on, let's see how it works.

Why: Hundreds of devices on a college network use private IPs, but the college may have only a few public IPs. NAT lets many private devices share one public IP.

How: The router rewrites the source address of outgoing packets from the private IP to its public IP and keeps a translation table so replies go back to the correct device. The variant that also changes ports (many-to-one) is called PAT or NAT overload.

  Private LAN (192.168.1.0/24)                 Internet
 +------------------+
 | Laptop           |  src 192.168.1.10:50001
 | 192.168.1.10     |------+
 +------------------+      |      +-------------------+   src 49.36.12.7:61001
                           +----->|  NAT Router       |----------------------->  google.com
 +------------------+      |      |  Public 49.36.12.7|<-----------------------
 | Phone            |------+      +-------------------+   reply to 49.36.12.7:61001
 | 192.168.1.11     |               NAT table:
 +------------------+               192.168.1.10:50001 <-> 49.36.12.7:61001

NAT type	Mapping	Example
Static NAT	1 private ↔ 1 public (fixed)	EC2 public IP / Elastic IP mapping
Dynamic NAT	private ↔ one from a pool of public IPs	Enterprise routers
PAT / NAT overload	many private → 1 public using ports	Home Wi-Fi, AWS NAT Gateway

Ravindra Bagale's Tip

When designing a VPC, never choose 192.168.0.0/16 – it clashes with most home and office Wi-Fi networks, and later VPN connections break. For every project I choose a range like 10.20.0.0/16. Plan your CIDR once, thoughtfully – changing it later is a big headache.

Ravindra Bagale's Tip – मराठी

VPC design करताना 192.168.0.0/16 कधीच निवडू नका – तो बहुतेक घर आणि office Wi-Fi networks शी clash होतो, आणि पुढे VPN connections तुटतात. मी प्रत्येक project साठी 10.20.0.0/16 सारखा range निवडतो. CIDR एकदाच, विचार करून plan करा – नंतर बदलणं खूप त्रासाचं आहे.

Ravindra Bagale's Tip – हिंदी

VPC design करते समय 192.168.0.0/16 कभी मत चुनना – वो ज़्यादातर घर और office Wi-Fi networks से clash होता है, और आगे VPN connections टूटते हैं. मैं हर project के लिए 10.20.0.0/16 जैसी range चुनता हूँ. CIDR एक बार, सोच-समझकर plan करो – बाद में बदलना बहुत सिरदर्द है.

Ravindra Bagale's Tip

Many students think that because of NAT, anyone outside can reach their private laptop. It's the opposite – NAT allows connections going from inside to outside and their replies, but a new connection from outside does not come in automatically. The AWS NAT Gateway works the same way: updates download from the private subnet, but nobody from the internet can get in.

Lab

Chala, hostname -I aani curl -s https://checkip.amazonaws.com tumchya laptop var chalva aani varcha NAT table tumchya IPs vaprun punha kadha: private IP:port → router cha public IP:port. Mag mobile hotspot var jaun parat kara aani public IP badalla ka te bagha.

Got it? NAT means many private devices, one public IP. Now let's move on and see where all of this appears in AWS.