nat overload, one address for a whole network

the reel

you've probably seen the config: ip nat inside source list 1 interface Gi0/0 overload. one line, and suddenly every device on your private network shares a single public ip address. this is pat, port address translation, also called nat overload, and it's the reason your home network with fifteen devices only ever shows up as one ip address to the outside world. let's break down what's actually happening so you understand your own network instead of just trusting the blinking lights on the router.

why "one address for a whole network" even works

normal nat is one-to-one. one private ip maps to one public ip. that doesn't scale, ipv4 addresses are expensive and scarce, and no isp is handing out a public address for every laptop and smart toaster in your house.

pat solves this by adding a second variable to the mapping: the port number. instead of just tracking "private ip goes to public ip," the router tracks "private ip plus private port goes to public ip plus a specific port." since there are over 65,000 possible ports, one public address can juggle thousands of simultaneous private conversations. that's the "many-to-one" part in the caption. it's not magic, it's bookkeeping.

breaking down the command

the config usually looks like this:

interface Gi0/1
 ip nat inside

interface Gi0/0
 ip nat outside

access-list 1 permit 192.168.1.0 0.0.0.255

ip nat inside source list 1 interface Gi0/0 overload

here's what each piece is doing:

ip nat inside and ip nat outside tell the router which interface faces your private network and which faces the internet. the router needs this to know which direction traffic is going, so it knows when to translate and when to leave things alone.

access-list 1 defines which private addresses are even allowed to be translated. this matters for defenders because a sloppy or overly broad access-list is a common misconfig. if your acl accidentally matches more than your intended subnet, you could be translating traffic you didn't mean to expose.

ip nat inside source list 1 interface Gi0/0 overload ties it together. it says "take anything matching acl 1, and translate its source address using whatever ip is on Gi0/0." the overload keyword is the whole trick. without it, you'd need one public ip per device, which defeats the purpose. with it, the router starts using port numbers to keep every session distinct.

what the translation table actually looks like

run show ip nat translations on a cisco device and you'll see entries like:

Pro  Inside global     Inside local      Outside local  Outside global
tcp  203.0.113.5:41522 192.168.1.10:443  198.51.100.9:443  198.51.100.9:443
tcp  203.0.113.5:41601 192.168.1.15:443  198.51.100.9:443  198.51.100.9:443

notice both internal hosts share the exact same public ip, 203.0.113.5, but get different port numbers. that's the whole mechanism. the router keeps this table in memory so return traffic knows exactly which internal device to forward the response to. this is also why nat isn't really a firewall, even though it feels like one because outsiders can't just address your internal devices directly. it's a side effect of address translation, not an intentional security control.

why this matters for defenders

understanding pat helps you read your own logs correctly. if you're investigating outbound traffic from your network, your firewall or isp will only see the public ip and a port number, not which internal device actually made the connection. if you don't have ip nat translations or equivalent logging turned on and retained, you lose the ability to map a suspicious outbound connection back to a specific machine on your own network during an incident. that's the real-world defensive lesson here: nat overload gives you address conservation, not visibility, and you have to build the visibility yourself.

check your own setup:

show ip nat translations
show ip nat statistics

these commands show you active sessions and how heavily your overload pool is being used. if you see translation counts that look way higher than your device count, that's worth investigating, it could be normal chatty apps or it could be something on your network generating a lot more outbound sessions than it should.

the takeaway

pat is just the router doing math with ports so one address can represent a whole network. it's efficient, it's everywhere, and it's not a security feature even though it feels like one. the actual defensive move is logging your translation table so you can trace outbound activity back to a device when something looks off, because from the outside, your entire network looks like a single ip and a pile of port numbers.