How does NATing work

Question

I'm not 100% understanding how NATing works. Let me setup our network and talk this through.

So first of all, lets say that I have an IP size of 4 bits so 16 possible combination. The only private IPs are 1.1.*.* this means that on my local network I can have 4 computers with addresses:

1.1.0.0
1.1.0.1
1.1.1.0
1.1.1.1

And in total on the internet there are (2^2-1)*2^2=12 public addresses which is a total of 12 public and 4 private = 16.

But if I didn't have the public/private scheme I'd still have 2^4=16 addresses.

How does NATing increase the number of computers on the LAN that can be addressed? I'm not at all understanding.

I can't see how using ports can increase the number of computers on a LAN. Each computer still has it's own address so why would the number of total devices increase?

Answer 1

When you reserve certain addresses for private use, the overall actual address space is increased because everyone can use that very same address space.

In real-world IPv4 addressing, 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 are reserved for private use, ie. these addresses cannot appear in the public Internet. Ignoring unusable bit combinations for simplicity, these make 2^16+2^20+2^24=17,891,328 addresses that anyone can use freely in a private network. Let's call that X.

For Internet connectivity, NA(P)T can now translate an entire private network to a single public address. Theoretically, any public address could 'hide' that number of private addresses behind it. So, the entire number of usable IPv4 addresses increases to (2^32-X)*X, roughly 76.5 quadrillion addresses instead of the initial 4 billion.

Of course, that isn't really practical but it shows that there's a significant increase of addresses if you only require outbound connectivity.

Also, you cannot simply map a (large) number of private IP addresses to a single public address on the network layer - you'd need the same number of public addresses as you've got private ones. Instead, the translation also involves the transport layer and uses port numbers to map an outbound client connection (PrivateIP:PrivatePort) to a unique public-facing port (PublicIP:PublicPort), so that replies to that port can be translated back to the initial PrivateIP:PrivatePort and forwarded to the initial requester.

Answer 2

NAT changes one address into another. That can be a simple one-to-one mapping, requiring one public address for each private address. But few organizations have the address resources to do that. Thus we have NAPT -- address and port translation. This allows a many-to-one mapping, where a single public address can be substituted for many private addresses.

If you change just the IP, one public address can only be mapped to one private address. There's no simple way to differentiate the traffic to more than one private address. If you change the IP and PORT, a public IP:PORT can map to a private IP:PORT; the port then becomes an extra key to identify which mapping to use. (pub IP:port1 = priv IP1:port1, pub IP:port2 = priv IP2:port1) Two private hosts can use the same port, but when translated one of them has to use a different port. As this is all done for source addressing, it rarely breaks anything.

Using NAPT, one public address can support thousands of translations, for thousands of private addresses. (and with most NAT systems including the destination in the key, there's the potential for hundreds of thousands of translations using a single public address.)