If the private address block is simply used to allow the router to determine where packets can and cannot be forwarded from (because private addresses need to be unique on their own network, but can repeat on different networks), then why would you need a network address translation service?

Why wouldn't you just skip the private address altogether and assign a public one if the host needs to connect to a network?

Thanks to everyone, the answer is much clearer now. The reasoning for the private addresses had escaped me, and I was confused why we would need it when so many IP addresses were wasted through classed addressing. I didn't (and still don't really) understand why we couldn't have just reassigned IP's to make better use of the addresses that we already have.

  • 11
    Sorry but your avatar is exactly what I did after reading this question. :P
    – Garrett
    Apr 6, 2012 at 17:55
  • 1
    Also, Google "IP address shortage" and you'll have your answer.
    – Garrett
    Apr 6, 2012 at 17:56
  • @Garrett: Sorry if you think that I am stupid, but the way that the CISCO online manual explained it was that only certain networks need to be private, and then went on to say that private hosts shouldn't NEED to access the internet. Based on that, NAT seems stupid. Now that I have gotten clarification from people who actually work in the field, this is much clearer. Apr 6, 2012 at 21:27

4 Answers 4


One reason NAT exists is because, with IPv4, there are a severely limited number of addresses available (a theoretical maximum of about 4.3 billion). For this reason, in most residential circumstances, an Internet Service Provider provides at most one public IP address to a subscriber at a time. If you would like to send and receive packets on multiple machines, it is necessary to have some kind of a local-public conversion, in other words NAT.

IPv6 will change all that as there should be something like thousands or millions of IP addresses per square foot of the Earth's surface.

  • 3
    ...which means that my nanobot network blanketing the globe will use up the available addresses in IPv6 and necessitate the move to IPv8 or IPv9000 or whatever comes after it.
    – zzzzBov
    Apr 6, 2012 at 20:10
  • 1
    @zzzzBov if you can fit 6.8*10^17 bots on every square millimeter on the face of the earth you will need IPv7 or higher Apr 6, 2012 at 20:27

Why wouldn't you just skip the private address altogether and assign a public one if the host needs to connect to a network?

Because there are not enough public addresses in IP version 4 to give every possible Internet connected device a unique address. This is why IP version 6 uses more bits for the address range and has more addresses.

Private address blocks are not supposed to be routable over the public Internet (this is what makes them "private"). Since there are only 3 private blocks with a relatively small number of addresses within them, they are guaranteed to be reused by anyone and everyone who has a private network (private addresses ONLY need to be unquie within a private network, but another private network might reuse the same addresses). So you cannot just put the private address blocks "out there" - they will conflict with someone else who is using the same block elsewhere.

So this is why NAT is needed.

To directly answer your last statement, if you have enough public addresses available to you, then you don't need NAT to send and receive traffic. NAT isn't necessary for this reason if you aren't trying to "save" IP addresses. For completeness, I'll say this: some people rely on the following side effects of NAT for security reasons and that could be a reason to elect to use it even if you do have enough public IP addresses:

  • users behind a NAT cannot receive incoming connections unless incoming traffic is explicitly forwarded to the them by the router
  • since outgoing traffic from NAT looks like to external systems that it comes from the router's IP, this hides details of the machines behind the NAT from external systems, i.e. how many machines, their private IPs, etc.

(Personally I wouldn't rely on a NAT for security if I didn't otherwise need it but YMMV)

  • Additionally, as wikipedia points out on the NAT page: As described, the method enables communication through the router only when the conversation originates in the masqueraded network Apr 6, 2012 at 18:07

There is not an infinite amount of IPv4 addresses, which in turn has made ISP:s not wanting to give out multiple addresses to its customers (without extra fees). Thus everyone gets one public IP address (often not even static, to also be able to offer that for a price premium), and when multiple home devices became the norm, NAT routing was the solution that became standard. Hardware manufacturers rejoiced :-) .

That is the economic part of why we "need" NAT translation, and at least on a home user scale, I believe it has been the driving reason.

Once IPv6 hits in a big way, everything should get a publicly routable unique address. This will happen sometime, definitely within 10 years, perhaps within 5. If something is certain, it is that we are notoriously bad at predicting the breakthrough of this :-) .


Besides IP shortage there is another important reason: security.

Let's imagime large company with 10k+ computers. If all of them use real IP all 10k+ might be attacked from any where, so admin... oh, no: 1k+ admins should spent their time to fix, patch and slap on users' frolicsome but wry hands.

With gray IPs we eliminate half the danger or maybe more.

  • 3
    NAT does little for security. The fact that your NAT box is also state-full firewall provides security, but any state-full firewall could block incoming request with exactly the same effect as NAT. Whats more, it actually is a vulnerability because your single public IP is a point of infection for multiple computers (what if someone hacks your NAT), on the other-hand, a well engineered IP6 set up has a firewall that is invisible to the outside world, and each incoming computer has a unique IP address. At the smallest possible local network size that is 2^64 address to scan.
    – Philip JF
    Apr 7, 2012 at 1:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .