AQA A-Level Computer Science (7517)

## Learning Outcomes

- Explain what **Network Address Translation (NAT)** is and why it is used
- Distinguish clearly between **private IP addresses** and **public IP addresses**
- Describe step by step how a router uses a **translation table** to handle outgoing and incoming packets
- Explain how **port numbers** help a router return data to the correct internal device
- Understand what **port forwarding** is and why it is needed for internal servers
- Compare simple NAT, dynamic NAT, and Port Address Translation in exam-safe terms
- Avoid common mistakes in short-answer and extended exam responses on NAT

## AQA A-Level Computer Science (7517) Syllabus

For the AQA A-Level Computer Science (7517), you are expected to understand NAT as part of communication and networking, with a focus on the following syllabus points:

- Know that devices on a LAN often use **private IP addresses** which are not Internet-routable
- Identify the difference between **public** and **private** IP addresses
- Explain why **NAT** is needed when a device with a private IP address communicates over the Internet
- Understand how a **router** rewrites address information as packets leave and return to a network
- Describe the role of a **translation table** in matching return traffic to the correct internal host
- Understand how **port numbers** may be used to keep different connections separate
- Explain what **port forwarding** does and why it is used for access to services inside a private network
- Recognise that NAT helps reduce demand for scarce **IPv4** public addresses

## Test Your Knowledge

_Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, look more closely at that area during your revision._

1. Why can a computer with a private IP address not normally be contacted directly from the Internet?
2. How does a router know which internal device should receive a reply packet?
3. What problem does NAT help solve in IPv4 networking?
4. What is the difference between NAT and port forwarding?
5. Why is it wrong to say that NAT alone is a complete security system?

## Introduction

When a home network, school network, or office LAN connects to the Internet, most of its devices do not have their own public Internet address. Instead, they usually use private addresses such as **192.168.x.x** inside the local network, while the router has the public address used on the Internet-facing side.

This creates a problem. Private addresses work inside the LAN, but they are not routable across the public Internet. **Network Address Translation (NAT)** solves that problem. It lets internal devices send and receive Internet traffic by having the router translate between private and public addressing information.

> **Key Term: Network Address Translation (NAT)**
> The process in which a router or similar edge device rewrites IP address information so that devices using private addresses on a local network can communicate with external networks.

For the exam, you need more than a one-line definition. You need to know why NAT is needed, how the translation happens, what information the router stores, and how this differs from port forwarding.

### Why NAT is needed

To understand NAT properly, start with the difference between public and private addressing.

A **public IP address** is globally unique and can be routed across the Internet. If a web server has a public IP address, devices elsewhere on the Internet can send packets to it directly.

A **private IP address** is used only inside a local network. It must be unique only within that network, not across the whole Internet. The same private address can appear in many different homes and businesses at the same time. For example, thousands of routers may all have an internal device using **192.168.0.3**. That is fine locally, but it means the address cannot be used as a unique Internet destination.

> **Key Term: public IP address**
> An IP address that is globally unique and routable on the Internet.
>
> **Key Term: private IP address**
> An IP address used within a local network that is not directly routable on the public Internet.

Private IPv4 addresses come from reserved ranges. You are not usually expected to memorise every range, but you should recognise that **192.168.x.x** is private. A private address is **non-routable** externally. That means Internet routers do not use it as a valid destination across the public network.

> **Key Term: non-routable**
> Describes an address that cannot be used for direct routing across the public Internet.

Why does this matter? Suppose a laptop on a home network with IP address **192.168.1.12** requests a web page. If that private address were sent out unchanged as the source address, the web server would try to reply to **192.168.1.12**. But that address has meaning only inside the home LAN. It is not a valid public destination, so the reply would never reach the laptop.

This is the first big reason for NAT: **private addresses cannot be used directly on the Internet**.

The second big reason is **IPv4 address shortage**. IPv4 uses 32 bits, so the number of possible public addresses is limited. If every phone, laptop, printer, games console, smart TV, and sensor needed its own public IPv4 address, the shortage would be much worse. NAT allows many internal devices to share one public address, usually the router's address.

This means NAT is mainly about two things:

- allowing private-address devices to access external networks
- conserving public IPv4 addresses

A third benefit is that internal addressing is hidden from the outside world. However, do not overstate this. NAT may reduce exposure, but it is not the same as a full firewall or full security policy.

> **Test Tip:** For a 2-mark “why is NAT used?” question, the safest answers are: private IP addresses are not Internet-routable, and many devices can share one public IPv4 address, conserving public addresses.

### How NAT works step by step

The exam often tests process, not just vocabulary. You should be able to describe packet flow in the correct order.

Imagine this setup:

- A computer on the LAN has private IP address **192.168.0.3**
- The router's public IP address is **230.117.156.130**
- The computer requests data from a web server on the Internet

The internal computer sends a packet towards the router. In that packet, the source IP address is **192.168.0.3**. If the router sent this packet straight onto the Internet unchanged, the reply could not return properly. So the router performs NAT.

The basic process is:

1. The internal device creates a request packet with its private source IP address.
2. The packet reaches the router at the edge of the network.
3. The router replaces the private source IP address with its own public IP address.
4. The router records translation details so it can reverse the change later.
5. The modified packet is sent out across the Internet.
6. The external server replies to the router's public IP address.
7. The router checks its stored translation information.
8. The router changes the destination details back to the internal device's private address.
9. The packet is forwarded to the original internal computer.
   > **Key Term: translation table**
   > A record kept by the NAT router showing how internal addresses and ports map to external addressing information so return traffic can be sent to the correct host.

A strong answer explains not just that “the router changes the IP address” but also **why the table is necessary**. Without the translation table, the router would receive return packets but would not know which machine on the LAN originally made the request.

In real networks, port numbers are usually part of the process as well. A connection is not identified only by IP address. The transport layer also uses **port numbers** to direct data to the correct application.

Suppose:

- Computer A at **192.168.0.3** sends a request using temporary source port **50272**
- Computer B at **192.168.0.4** also sends a request
- Both are sharing the same public router IP

If the router changed only the IP address and not the port information, it could struggle to separate multiple simultaneous sessions. So a common form of NAT also uses port translation.

> **Key Term: socket**
> A communication endpoint identified by an IP address and a port number.

For example, the router may map:

- **192.168.0.3:50272** to **230.117.156.130:61001**
- **192.168.0.4:50310** to **230.117.156.130:61002**

Now both computers can use the same public IP address at the same time. When reply packets return, the router uses the destination port number in the reply to look up the right internal machine.

This is often called **Port Address Translation (PAT)** or NAT overload. For AQA, NAT is the core term you must know, but understanding that ports help distinguish sessions makes your explanation stronger and more realistic.

> **Key Term: Port Address Translation (PAT)**
> A common form of NAT in which many internal devices share one public IP address and are distinguished using port numbers.

A router may also drop incoming packets that do not match an existing table entry. That is because they are not recognised as responses to an internal request. This reduces some unwanted inbound traffic, but again, do not write that NAT alone “prevents hacking”. That is too absolute.

Common student errors here include:

- saying the internal device's private address becomes public permanently
- forgetting the role of the router and claiming the server performs the translation
- not mentioning the translation table in a process answer
- confusing port numbers with IP addresses
- saying NAT gives every internal device a unique public IP
  > **Test Tip:** In a 4- or 6-mark “describe how NAT works” answer, write in sequence: internal request, router replaces source IP, router stores mapping, response returns to router, router uses stored entry, packet forwarded to original host.

### NAT, DHCP and types of NAT students confuse

Students often mix up NAT with other networking functions, especially **DHCP**. They are not the same.

**DHCP** automatically assigns configuration details to devices joining a network. That usually includes an IP address and subnet mask, and often other settings. DHCP decides what local address a machine should use on the network. NAT deals with what happens when traffic crosses between the private LAN and an external network.

> **Key Term: Dynamic Host Configuration Protocol (DHCP)**
> A protocol that automatically assigns IP configuration details, such as an IP address and subnet mask, to a device on a network.

So:

- **DHCP** gives a device an internal address
- **NAT** translates between internal and external addressing as packets move through the router

The word “dynamic” appears in both DHCP and dynamic NAT, which confuses some students. These are different ideas.

A useful comparison is below.

DHCP

- assigns IP settings to a host
- used when a device joins a network
- mainly about configuration
- often allocates from a pool temporarily using a lease

NAT

- rewrites address details in packets
- used when traffic crosses network boundaries
- mainly about communication between address spaces
- lets private IP devices use external networks

You may also meet different NAT forms:

Static NAT

- one private IP maps permanently to one public IP
- useful if one internal machine must always appear as the same public host

Dynamic NAT

- one private IP maps temporarily to one address from a pool of public IPs
- used as needed, not permanently fixed

PAT / many-to-one NAT

- many private IPs share one public IP
- different sessions are tracked using port numbers
- common in home routers

For AQA, the priority is ordinary exam-level NAT: the router replaces a private source IP with its own public IP, keeps translation information, and reverses the process for returning traffic. Static NAT and PAT are extension ideas, but they help explain common real-world behaviour and can stop confusion.

One subtle point students miss: NAT is not needed because “the Internet cannot handle local networks”. NAT is needed because **private addresses are not globally routable** and because public IPv4 addresses are limited.

### Port forwarding and inbound access

Ordinary NAT is best at handling **outgoing** requests that begin inside the LAN. An internal device asks for data, the router records the mapping, and replies can come back.

But what if someone on the Internet wants to start the connection to a server inside the private network?

For example, suppose a company has an internal web server:

- internal server IP: **192.168.20.4**
- router public IP: **103.12.94.56**
- web traffic uses port **80**

An external user cannot send packets directly to **192.168.20.4** because that is a private, non-routable address. Also, the router will not automatically know which internal device should receive an unsolicited incoming packet. There is no matching NAT entry yet, because the request did not start from inside.

This is where **port forwarding** is used.

> **Key Term: port forwarding**
> A rule on a router that forwards traffic arriving at a specified public port to a specified private IP address and port inside the network.

A router can be configured with a rule such as:

- traffic arriving at **103.12.94.56:80**
- forward it to **192.168.20.4:80**

Now the outside user sends the request to the router's public IP address. The router checks its port forwarding rules and passes the traffic to the internal server.

This is why port forwarding is often described as being used to expose a service hosted on a private network. Common examples include web servers, game servers, or remote access services.

The key distinction is this:

- **NAT for outbound traffic** usually happens automatically when an internal host initiates communication
- **port forwarding for inbound traffic** needs a configured rule telling the router where to send packets received on a given port

Students often write that port forwarding “is NAT”. A better answer is that port forwarding is commonly used alongside NAT and depends on address translation at the network edge, but it is a specific mapping rule for incoming traffic.

There is also a security issue here. Port forwarding increases accessibility, but it also creates an intended path from the public Internet to an internal device. That means the service being exposed must be configured carefully.

A balanced exam point is:

- advantage: allows external access to a server on a private LAN
- limitation: increases exposure and must be configured correctly

Common errors on this part include:

- saying the external client connects directly to the private IP
- forgetting to mention the router's public IP
- claiming port forwarding is only used for web servers
- confusing destination port with source port
  > **Test Tip:** If the question mentions an internal server being accessed from outside the network, think “port forwarding”, not just ordinary NAT.

## Key Point Checklist

_This article has covered the following key knowledge points:_

- NAT translates between private and public IP addressing at a router or edge device
- Private IP addresses are used inside local networks and are not directly routable on the public Internet
- Public IP addresses are globally unique and routable across the Internet
- NAT is needed because private addresses cannot be used directly on the Internet and because public IPv4 addresses are limited
- A router performing NAT replaces the source private IP address with its public IP address for outgoing traffic
- The router stores mapping information in a translation table so return packets can be sent to the correct internal host
- Port numbers can be used to distinguish simultaneous connections from different internal devices sharing one public IP
- PAT is a common many-to-one form of NAT that uses port numbers
- DHCP assigns IP configuration to devices joining a network, while NAT translates addresses when traffic crosses network boundaries
- Port forwarding sends traffic from a specified public port to a specified private IP address and port inside the LAN
- Port forwarding is commonly used to allow inbound access to an internal server
- NAT hides internal addresses but should not be described as a complete security solution by itself

## Key Terms and Concepts

- Network Address Translation (NAT)
- public IP address
- private IP address
- non-routable
- translation table
- socket
- Port Address Translation (PAT)
- Dynamic Host Configuration Protocol (DHCP)
- port forwarding


Communication and Networking - NAT