Skip to content

NAT & Private IP Ranges

Why Private IP Ranges Exist

IPv4 only has ~4.3 billion addresses total — nowhere near enough for every device on every private network to have a unique public one. RFC 1918 reserves three ranges for private, internal-only use — anyone can reuse them inside their own network without conflicting with anyone else's, because they're never routed on the public internet:

Range CIDR Size Common use
10.0.0.0 – 10.255.255.255 10.0.0.0/8 ~16.7M addresses Large enterprise (this wiki's examples use 10.x.x.x)
172.16.0.0 – 172.31.255.255 172.16.0.0/12 ~1M addresses Medium networks
192.168.0.0 – 192.168.255.255 192.168.0.0/16 ~65K addresses Home/small office (most consumer routers default here)

Other Reserved Ranges Worth Knowing

Range Purpose
127.0.0.0/8 Loopback (127.0.0.1 = "this host")
169.254.0.0/16 Link-local (APIPA) — a host self-assigns from here when DHCP fails
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 Reserved for documentation/examples (used instead of real public IPs in guides)

NAT (Network Address Translation)

NAT translates between private addresses (used internally) and public addresses (used on the internet), letting an entire private network share one or a handful of public IPs. The router performing NAT rewrites the source (and/or destination) address as packets cross between "inside" and "outside."

Types of NAT

Type Behavior Typical use
Static NAT One private IP always maps to one specific public IP, in both directions Hosting an internal server that needs a consistent public address
Dynamic NAT Private IPs draw from a pool of public IPs, first-come-first-served Rare today — limited by needing as many public IPs as simultaneous internal hosts
PAT / NAT Overload Many private IPs share one public IP, distinguished by port number The default on virtually every home/office router — this is "NAT" in everyday usage

PAT (Port Address Translation) is why NAT actually scales: each internal host's connection gets mapped to the shared public IP plus a unique port, so the router can tell return traffic apart even though it all arrives at the same public address.

Basic Cisco IOS NAT Overload (PAT) Example

interface Gi0/1
 ip address 10.0.10.1 255.255.255.0
 ip nat inside

interface Gi0/48
 ip address 203.0.113.5 255.255.255.252
 ip nat outside

ip access-list standard NAT_SOURCES
 permit 10.0.10.0 0.0.0.255

ip nat inside source list NAT_SOURCES interface Gi0/48 overload
  • ip nat inside / ip nat outside mark which interfaces face the private network vs. the internet
  • The ACL defines which internal addresses are allowed to be translated
  • overload is what makes this PAT (all sources share the outside interface's single IP) rather than one-to-one dynamic NAT

Verify:

show ip nat translations   ! View active translation table entries
show ip nat statistics     ! Hits, active translations, configured inside/outside interfaces