NAT (network address translation)

Network address translation (NAT) is the rewriting of source or destination IP addresses, and often ports, in packets as they cross a router or gateway. Its most common use lets many hosts with private addresses, such as 10.0.0.0/8, reach the internet through one or a few public IP addresses. Replies are translated back to the right private host.

How it works

Source NAT (SNAT) rewrites the sender's address on the way out and records the mapping in a connection-tracking table. Destination NAT (DNAT) rewrites the target address on the way in, which is how port forwarding works. On Linux, iptables rules in the nat table implement both. For example, iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE lets a machine share its internet connection. Kubernetes uses similar rules to route Service traffic to pods.

Why it matters in production

Managed NAT gateways in the cloud usually charge per GB of data processed. A workload that pulls 100 TB per month from the internet can make NAT one of the largest line items on the bill. NAT also hides the original client address and can exhaust source ports under heavy connection churn.