Port Address Translation in Practice

A small business has 50 employees, one public IP from their ISP, and no plans to buy more. They need everyone to reach the internet. Without PAT, they'd have to buy 50 public IPs — or use a proxy. With PAT, one public address handles all 50 with no degradation for standard browsing.

PAT (also called NAT overload) is the single most common NAT configuration in the world. Every home router does it. Most small-business firewalls do it. Understanding it is essential.

#The Mechanics#link

That's the whole trick. Two clients using the same source port (30001) to reach the same destination both get mapped to different outside ports (40001 and 40002). Return traffic is matched on the outside port and translated back to the correct client.

#Configuring PAT#link

The `overload` keyword is what makes it PAT. Without it, the config would be dynamic NAT — one public IP per inside host. With `overload`, the router reuses public IPs by differentiating connections via port.

#Static PAT — Port Forwarding#link

Static PAT translates a specific port on the outside IP to a specific port on an inside server. This is how you publish services from behind NAT. The last example forwards external port 2222 to internal port 22 — used to avoid exposing SSH on the standard port.

#Verification and Troubleshooting#link

`Hits: 182734` shows active translations. `Misses: 234` indicates packets that arrived without a matching translation — usually return traffic for a translation that timed out, or inbound traffic that no NAT rule matched.

#The Scenario Diagnosis#link

#Common Mistakes#link

• ▪ACL number mismatch between the `access-list` and `ip nat inside source` commands
• ▪Missing `overload` — the config silently becomes dynamic NAT with pool exhaustion
• ▪Inside/outside interfaces not marked — no translation at all
• ▪Static PAT with reversed ports — service is published on the wrong port
• ▪Pool IPs not actually routed to you by the ISP — return traffic never arrives