What is PAT?

PAT (Port Address Translation) is the common form of NAT where many inside hosts share one public IP address, their connections kept apart by port.

When a host at 10.0.0.10 opens a connection from port 51000 to a web server, the router rewrites the source to its public address, say 203.0.113.5, and normally keeps the port. A second host at 10.0.0.11 using the same source port has its port changed to a free one, say 51001, if keeping it would make two connections indistinguishable. The router records each mapping in a translation table (on Linux, conntrack), and when a reply comes back to 203.0.113.5:51001 it looks up the entry and sends the packet to 10.0.0.11:51000 with the addresses reversed. TCP and UDP have 16-bit port numbers, so one public address offers roughly 64,000 ports per protocol, and connections to different destinations can often reuse the same port, which lets one address carry a great many users.

PAT goes by several names: NAPT (Network Address and Port Translation), "NAT overload" on Cisco, and masquerade on Linux and VyOS, which is PAT using whatever address the outgoing interface has. Most home routers do exactly this. Because mappings are only created by outbound traffic, an unsolicited packet arriving from the internet has nowhere to go, which is why inbound services need a port forward (DNAT). That behaviour is often mistaken for a firewall, but it isn't one: you still need a forward firewall. PAT is a kind of SNAT, and ISPs running CGNAT apply the same idea at a much larger scale. The Setting up VyOS with NAT lesson configures source NAT for a private LAN and shows the translations it creates.