PAT: many hosts, one address

Overload

PAT (Port Address Translation, or NAT overload) lets many inside hosts share one public address. The router tells the conversations apart by their port numbers (and, for ping, the ICMP query ID). This is what nearly every home and office router does.

The usual setup uses the outside interface's own address, so you don't need spare public addresses:

ip nat inside source list 1 interface g0/1 overload

In NetLab

▶ R1
R1>enable
R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)#ip nat inside source list 1 interface g0/1 overload
R1(config)#end
*Mar  1 00:00:05.000: %SYS-5-CONFIG_I: Configured from console by console
▶ PC1
NetLab Windows-style command prompt. Type help to see the commands.
C:\Users\student>ping 198.51.100.10

Pinging 198.51.100.10 with 32 bytes of data:
Request timed out.
Request timed out.
Reply from 198.51.100.10: bytes=32 time<1ms TTL=62
Reply from 198.51.100.10: bytes=32 time<1ms TTL=62

Ping statistics for 198.51.100.10:
    Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
▶ PC2
student@PC2:~$ curl http://198.51.100.10
<html><body><h1>Welcome to WEB</h1></body></html>
▶ PC3
NetLab Windows-style command prompt. Type help to see the commands.
C:\Users\student>curl http://198.51.100.10
<html><body><h1>Welcome to WEB</h1></body></html>
▶ R1
R1#show ip nat translations
Pro  Inside global         Inside local          Outside local         Outside global
icmp 203.0.113.2:10        192.168.1.10:10       198.51.100.10:10      198.51.100.10:10
tcp  203.0.113.2:49163     192.168.1.20:49163    198.51.100.10:80      198.51.100.10:80
tcp  203.0.113.2:49164     192.168.1.30:49164    198.51.100.10:80      198.51.100.10:80

All three hosts appear as 203.0.113.2. Each line has a different inside local address and port, and R1 keeps the original port when it's free (if two hosts used the same port, it would pick another one for the second).