what is NAT router and how to setup it

Almost every home and small business network relies on NAT (Network Address Translation) to share a single public IP address among many devices. This article explains what NAT is, why it exists, the different types of NAT, and how to configure a NAT router in practice — both on a typical consumer router and on Linux using iptables/nftables.

Why NAT Exists

IPv4 has only about 4.3 billion addresses, nowhere near enough for every device in the world to have a unique public one. NAT solves this by letting many devices behind a router share a single public IP address, translating private addresses to that public address (and back) as traffic passes through.

Private IP Ranges (RFC 1918)

These addresses are not routable on the public internet — they only have meaning inside a private network, which is exactly why NAT is needed to translate them at the boundary.

How NAT Works

graph LR
    PC1[192.168.1.10] --> Router[NAT Router - Public IP 203.0.113.5]
    PC2[192.168.1.11] --> Router
    Router --> INT((Internet))

When 192.168.1.10 sends a packet to a web server, the router:

1. Replaces the source IP (192.168.1.10) with its own public IP (203.0.113.5).
2. Replaces the source port with a unique port it chooses, and records this mapping in a NAT translation table.
3. Sends the packet out to the internet.
4. When the reply comes back addressed to the public IP and that chosen port, the router looks up the table, rewrites the destination back to 192.168.1.10, and forwards it internally.

This specific and most common form is called PAT (Port Address Translation), sometimes called NAT overload, since many internal hosts share one public IP by being distinguished via port numbers.

Example NAT Translation Table

Types of NAT

Setting Up NAT on a Consumer Router

Most home routers do this automatically out of the box, but understanding the settings helps with troubleshooting:

1. Log in to the router admin panel (commonly 192.168.1.1).
2. Under WAN/Internet settings, confirm the WAN connection type (DHCP, PPPoE, or static, depending on your ISP).
3. NAT is typically enabled by default under a setting sometimes labeled “NAT” or implied by “Router Mode” (as opposed to “Bridge Mode,” which disables NAT and passes the public IP through).
4. Configure Port Forwarding for any internal service that needs to be reachable from the internet (e.g., a home web server, game server, or security camera NVR):

Setting Up NAT on Linux with iptables

Linux can act as a full NAT router — useful for lab environments, custom firewalls, or repurposed hardware.

Step 1: Enable IP Forwarding

sudo sysctl -w net.ipv4.ip_forward=1

sudo sysctl -w net.ipv4.ip_forward=1

Make it persistent:

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 2: Configure Masquerading (PAT)

Assuming eth0 is the internet-facing (WAN) interface and eth1 is the internal LAN interface:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

• MASQUERADE dynamically translates the source address to whatever address eth0 currently has — ideal when the WAN IP can change (e.g., DHCP).
• The FORWARD rules permit traffic initiated from the LAN out, and only return traffic back in (blocking unsolicited inbound connections by default).

Step 3: Port Forwarding (DNAT) with iptables

To forward external traffic on port 8080 to an internal web server at 192.168.1.50:80:

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 \
  -j DNAT --to-destination 192.168.1.50:80

sudo iptables -A FORWARD -p tcp -d 192.168.1.50 --dport 80 -j ACCEPT

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 \
  -j DNAT --to-destination 192.168.1.50:80

sudo iptables -A FORWARD -p tcp -d 192.168.1.50 --dport 80 -j ACCEPT

Step 4: Persist Rules

sudo apt install iptables-persistent
sudo netfilter-persistent save

sudo apt install iptables-persistent
sudo netfilter-persistent save

Modern Equivalent: nftables

sudo nft add table nat
sudo nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
sudo nft add rule nat postrouting oifname "eth0" masquerade

sudo nft add table nat
sudo nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
sudo nft add rule nat postrouting oifname "eth0" masquerade

NAT on Cisco Routers

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip nat outside
Router(config-if)# exit

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip nat inside
Router(config-if)# exit

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface gigabitEthernet 0/0 overload

Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip nat outside
Router(config-if)# exit

Router(config)# interface gigabitEthernet 0/1
Router(config-if)# ip nat inside
Router(config-if)# exit

Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface gigabitEthernet 0/0 overload

The overload keyword enables PAT, the Cisco equivalent of Linux’s MASQUERADE.

Verify active NAT translations:

Router# show ip nat translations

Router# show ip nat translations

Best Practices

• Never expose management interfaces (SSH, RDP, router admin panels) directly via port forwarding without additional protection (VPN, strong auth, IP allowlisting).
• Use static NAT/DHCP reservations for internal servers you plan to port-forward to, so their internal IP doesn’t change.
• Log NAT translation table usage on busy networks — running out of available ports under PAT can cause connection failures under heavy load.
• Combine NAT with a proper stateful firewall — NAT alone provides an incidental security benefit (hosts aren’t directly reachable), but shouldn’t be relied upon as your only defense.
• Document all port forwarding rules; unused/forgotten forwards are a common security liability.

Troubleshooting

Further Reading

• RFC 1918 — Address Allocation for Private Internets
• RFC 3022 — Traditional IP Network Address Translator
• Netfilter/iptables Documentation
• Cisco NAT Configuration Guide
• nftables Wiki

Conclusion

NAT was originally a stopgap for IPv4 exhaustion, but it has become deeply embedded in how home and business networks operate — providing both address sharing and an incidental layer of protection against unsolicited inbound connections. Understanding the translation process, and being comfortable configuring it on consumer routers, Linux, and Cisco gear alike, is a core networking skill.