NAT is a protocol that is used for connecting multiple devices on internal, private networks to a public network such as the internet, using a limited number of public IPv4 addresses. It was designed for conserving IPv4 address space.
NAT 是一種協定，用於將內部私有網路上的多個裝置連接到公用網路（例如網際網路），只需使用有限數量的公用 IPv4 位址。它的設計目的是節省 IPv4 位址空間。
The IPv4 address space is not large enough to uniquely identify all network-capable devices that need IP-based network connectivity. This limitation led to the development of private addresses. Private addresses are described in RFC 1918. Private addresses are not routed by internet routers and should be used only within an enterprise. Devices in the enterprise network must have a mechanism in place to "procure" a public address when they need internet access and to translate private addresses to public addresses. Public addresses are routed by internet routers. The mechanism that "procures" a public address for a device with a private address that needs access to the internet is NAT. NAT performs translations. Most commonly, the subject of translation is an IPv4 address, and it is translated from a private address to a public address.
IPv4 位址空間並不足以為所有需要 IP 型網路連線的裝置提供唯一識別。這項限制促成了私有位址的發展。私有位址在 RFC 1918 中有所描述。私有位址不會被網際網路路由器路由，僅應在企業內部使用。企業網路中的裝置必須具備一種機制，能在需要存取網際網路時「取得」一個公用位址，並將私有位址轉換為公用位址。公用位址則會被網際網路路由器路由。這種為需要存取網際網路的私有位址裝置「取得」公用位址的機制，就是 NAT。NAT 負責執行轉換。最常見的情況是，轉換的對象是 IPv4 位址，會將其從私有位址轉換為公用位址。
To illustrate how NAT performs its tasks, presume that an enterprise network uses a private IPv4 addressing scheme. The translation usually happens when a device in the enterprise network initiates communication with a device in the internet. Just before the packets enter the internet realm, a device at the border between the enterprise network and the internet translates or swaps the private address with a public address. The packets reach their destination in the destination device and, eventually, the same border device receives responses. It is important to note that responses are destined to the public address, and the public address is now written in the destination IPv4 address header field. The border device is the only device that knows how to translate the public address back to the appropriate private address. The translation now happens in reverse, public to private direction. The public address is translated back to the private address before the responses are forwarded to the initiator of the communication. The key point is that address translation, or address swapping, happens for traffic traveling in both directions, outbound and inbound.
為說明 NAT 如何執行其任務，假設某企業網路使用私有 IPv4 定址方案。轉換通常發生在企業網路中的裝置與網際網路上的裝置發起通訊時。就在封包進入網際網路領域之前，位於企業網路與網際網路邊界的裝置會將私有位址轉換或替換為公用位址。封包會到達目的裝置，最終同一台邊界裝置會收到回應。需要注意的是，回應的目的地是該公用位址，此時目的地 IPv4 位址標頭欄位中寫的就是這個公用位址。邊界裝置是唯一知道如何將公用位址轉換回對應私有位址的裝置。此時轉換方向相反，變成由公用轉為私有。在回應被轉送給通訊發起者之前，公用位址會先被轉換回私有位址。重點在於：位址轉換（或位址替換）會發生在雙向的流量上，也就是出向與入向流量都會進行轉換。
In an enterprise environment, NAT is usually implemented on border devices such as firewalls or routers. This implementation allows devices within an enterprise network to have private addresses to communicate among themselves and to translate addresses only when they need to send traffic to the internet or outside networks in general. When accessing the internet, the border device translates private addresses to public addresses and keeps a mapping between them, to match the returning traffic. In a home environment, this device might be an access point that has routing capability, or the DSL or cable router.
在企業環境中，NAT 通常實作在邊界裝置上，例如防火牆或路由器。這種實作方式讓企業網路內的裝置可以使用私有位址彼此通訊，只有在需要將流量送往網際網路或一般的外部網路時，才需要進行位址轉換。當存取網際網路時，邊界裝置會將私有位址轉換為公用位址，並保留兩者之間的對應關係，以便比對返回的流量。在家用環境中，這台裝置可能是具備路由能力的無線基地台，或是 DSL、cable 路由器。
NAT can also be used when there is an addressing overlap between two private networks. An example of this implementation would be when two companies merge and they were both using the same private address range. In this case, NAT can be used to translate one intranet's private addresses into another private range, avoiding an addressing conflict and enabling devices from one intranet to connect to devices on the other intranet. Therefore, NAT is not implemented only for translations between private and public IPv4 address spaces, but it can also be used for generic translations between any two different IPv4 address spaces.
當兩個私有網路之間出現定址重疊時，也可以使用 NAT。舉例來說，當兩家公司合併，且雙方原本都使用相同的私有位址範圍時，就可能發生這種情況。此時可以使用 NAT，將其中一個內部網路的私有位址轉換為另一個私有範圍，以避免定址衝突，並讓其中一個內部網路的裝置能連接到另一個內部網路的裝置。因此，NAT 並不僅用於私有與公用 IPv4 位址空間之間的轉換，也可以用於任兩個不同 IPv4 位址空間之間的一般性轉換。