Network Address Translation

As its name implies, Network Address Translation (NAT) is a technology with which the gateway substitutes internal private IP addresses with its own public address. This substitution is performed on every connection to and from the Internet. The advantage of NAT is its transparency to users and easy configuration, the primary reasons for its widespread popularity. For example, Microsoft ICS (Internet Connection Sharing) for Windows is based on NAT technology.

The generic nature of NAT makes building truly secure firewalls difficult. Since all types of connections are indiscriminately translated, their variety makes it difficult to develop effective filtering rules to detect and block all harmful traffic.

Another drawback of NAT is that is does not scale well. While it is not immediately obvious, the address translator (also known as a circuit-level proxy) must keep track of all its connections so it can return information from a server to the specific client that requested it. As the network size grows, this database of connections quickly becomes unwieldy.