Networking · Visual Explainer
NAT vs PAT vs Proxy
The concept
NAT rewrites one private IP to one public IP. PAT lets a whole office share one public IP using ports — that's your home router. A proxy is different entirely: it terminates your connection and opens its own, so it can read, cache, filter and log the actual content.
Key distinctions
| Term | What it means |
|---|---|
| NAT (Layer 3) | One-to-one address translation — 10.0.0.5 → 203.0.113.5. For servers needing a dedicated public identity. |
| PAT (Layer 3+4) | Many private IPs share one public IP, distinguished by port. This is why unsolicited inbound can't reach your laptop at home. |
| Proxy (Layer 7) | The client's connection ends at the proxy, which makes its own onward connection — so it can cache, filter, and terminate TLS. |
| The summary | NAT and PAT rewrite packet headers. A proxy speaks the protocol itself. |
Why it matters in practice
Configured all three for years across Juniper, Cisco, MikroTik, pfSense and Nginx. The X-Forwarded-For header detail is a classic gotcha — behind a proxy, apps see the proxy's IP unless you forward the real one.