What Is NAT? Network Address Translation Explained (2026)

You have a phone, a laptop, a TV and a games console all online at once - through a single internet connection with one public address. The technology making that work is NAT (Network Address Translation). It's invisible until you try to host something from home, where it suddenly becomes the obstacle. This guide explains what NAT is, how it works, the types, and the CGNAT problem that blocks self-hosting.

What NAT is

NAT (Network Address Translation) lets many devices on a private network share one public IP address. Each device has a private address (like 192.168.x.x) that can't be used on the public internet. When a device connects out, your router rewrites the packet to use its own public IP, remembers the mapping, and translates replies back to the right device.

NAT is why all your devices share one home connection - and a big reason IPv4 didn't run out years ago.

How it works

When a device sends traffic out, the router replaces the private source address and port with its own public IP and a unique port, recording the translation in a table. The destination sees only the router's public IP. When the reply returns, the router looks up the table and forwards it to the correct internal device.

This port-based form - PAT ("NAT overload") - is what lets one public IP serve dozens of devices at once, invisibly.

The types

Static NAT - one private IP ↔ one public IP, permanently.
Dynamic NAT - private IPs map to a pool of public IPs as needed.
PAT / NAT overload - many private IPs share one public IP via different ports (what home routers do).
DNAT (destination NAT) - the inbound direction, used in port forwarding to route an incoming public port to a specific internal device.

Open, moderate, strict: NAT types in games and calls

Game consoles and VoIP apps report a "NAT type" - the same NAT, described by how easily peers can reach you:

Open (Type 1) - your device has a direct public IP or full forwarding; everything connects, best for hosting matches and party chat.
Moderate (Type 2) - standard home NAT with some ports open; works for most, occasional matchmaking friction.
Strict (Type 3) - restrictive NAT (or CGNAT) that blocks most inbound; you get connection warnings, fail to host, and sometimes can't hear party members.

Moving from strict to open is usually a matter of port forwarding or enabling UPnP - unless CGNAT is in the way, in which case no router change helps.

Why NAT makes self-hosting harder

NAT is designed to allow outbound connections, not unsolicited inbound ones. Your devices reach the internet freely, but the internet can't reach them - the router has no mapping for an unexpected incoming connection, so it drops it.

To host a service (a VPN, game server, NAS), you must create that mapping yourself with port forwarding, and give it a stable address with dynamic DNS. NAT is a one-way door: great for security, inconvenient when you want to be reachable.

The CGNAT wall

CGNAT (Carrier-Grade NAT) is a second layer of NAT run by your ISP, where many customers share a pool of public IPs. The result: you don't have a real public IP of your own, so even port forwarding can't make you reachable - the public-facing address isn't yours to control. It's increasingly common on mobile and some fibre.

If you're behind CGNAT, self-hosting from home is effectively blocked. The clean fix is a VPS with its own public IP: a Contabo VPS at €5.50/month sidesteps NAT entirely with a permanent public address - see what a VPS is.

How to tell if you're behind CGNAT

A 30-second check: find your router's WAN IP (in its admin page) and compare it to what a "what is my IP" site shows. If they differ, your traffic is being NATed again upstream - you're behind CGNAT. A second giveaway is a WAN IP in the 100.64.0.0/10 range (the address block reserved specifically for carrier NAT). You can also ask your ISP for a public/static IP - some grant one free or for a small fee, which avoids needing a relay at all.

Reaching home without a public IP

If you can't get a public IP and don't want a VPS, overlay/mesh tools punch through NAT for you: WireGuard-based meshes (like Tailscale or self-hosted NetBird) and reverse tunnels (such as Cloudflare Tunnel) establish the connection outbound from both ends, so neither side needs an open inbound port. They're the practical workaround when CGNAT blocks classic port forwarding - see self-hosting with dynamic DNS for the public-IP path and NetBird for the mesh path.

The bottom line

NAT lets a whole network share one public IP by translating private addresses - invisible and essential for everyday browsing, and the reason IPv4 stretched this far. But it's a one-way door: it allows outbound, blocks unsolicited inbound, so self-hosting needs port forwarding. And if your ISP adds CGNAT, no router setting makes you reachable - a VPS with a real public IP is the way around it.

Editorial guide based on how NAT works (PAT, static/dynamic, DNAT) and CGNAT's impact on self-hosting. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

What is NAT?

NAT (Network Address Translation) is a technique your router uses to let many devices on a private network share a single public IP address. Each device has a private address (like 192.168.x.x) that isn't usable on the public internet, so when a device connects out, the router rewrites the packet to use its own public IP and remembers the mapping, then translates replies back to the right device. NAT is why your phone, laptop and TV can all be online through one home connection - and a big reason the internet didn't run out of IPv4 addresses years ago.

How does NAT work?

When a device on your network sends traffic to the internet, the router replaces the private source address (and often the port) with its own public IP and a unique port, recording the translation in a table. The destination sees only the router's public IP. When the reply comes back, the router looks up the table and forwards it to the correct internal device and port. This port-based form (PAT, or 'NAT overload') is what lets one public IP serve dozens of devices at once. The whole process is invisible to you in normal use.

What are the types of NAT?

The common ones: Static NAT maps one private IP to one public IP permanently. Dynamic NAT maps private IPs to a pool of public IPs as needed. PAT (Port Address Translation, also called NAT overload) maps many private IPs to one public IP using different ports - this is what home routers do. There's also the inbound direction, DNAT (destination NAT), used in port forwarding to send traffic arriving on a public port to a specific internal device. Most home setups rely on PAT for outbound and port forwarding (DNAT) for any inbound services.

Why does NAT make self-hosting harder?

Because NAT is built to allow outbound connections, not unsolicited inbound ones. Devices behind NAT can reach the internet freely, but the internet can't directly reach them - the router has no mapping for an unexpected incoming connection, so it drops it. To host a service (a VPN, game server, NAS), you must create that mapping yourself with port forwarding. NAT is effectively a one-way door that's great for security but inconvenient when you want to be reachable from outside.

What is CGNAT and why does it matter?

CGNAT (Carrier-Grade NAT) is a second layer of NAT run by your ISP, where many customers share a pool of public IPs. It means you don't have a real public IP of your own - so even port forwarding on your router can't make you reachable, because the public-facing address isn't yours to control. CGNAT is increasingly common on mobile and some fibre. If you're behind it, self-hosting from home is effectively blocked, and the practical fix is a VPS with its own public IP.