What Is NAT? Sharing One Public Address
NAT, network address translation, lets hosts with private IP addresses reach the internet by rewriting their traffic to use a shared public address on the way out.
Private subnets cannot route to the internet directly, yet their hosts still need to fetch packages and call external APIs. NAT solves this by translating private source addresses to a public one and tracking the mapping so replies return correctly. CI runners in private subnets depend on NAT for all outbound traffic.
Translating addresses
When a private host sends traffic out, the NAT device rewrites the source to its public address and remembers the mapping. When the reply comes back, it translates the destination back to the original private host.
Outbound only
NAT typically allows private hosts to initiate connections outward but does not let the internet initiate connections inward. This keeps private resources reachable for egress while shielding them from direct inbound access.
NAT and stable egress IPs
- All private hosts share the NAT public address.
- That gives a stable egress IP to allowlist downstream.
- It hides individual host addresses from the destination.
NAT in CI/CD
A runner in a private subnet downloads dependencies and calls APIs through a NAT gateway. Because traffic exits from one known address, downstream services can allowlist that single egress IP.
When NAT becomes a bottleneck
A NAT gateway has connection and bandwidth limits. A large fleet of runners doing heavy downloads can exhaust ports or saturate the gateway, causing intermittent connection failures.
Transient NAT pressure
Connections that fail because the NAT gateway is briefly saturated are transient and often succeed on retry. Latchkey runners retry these transient egress failures to common endpoints so a momentary NAT spike does not fail a job.
Key takeaways
- NAT lets private hosts reach the internet through a shared public address.
- It allows outbound connections while blocking unsolicited inbound ones.
- A saturated NAT gateway causes intermittent, retryable egress failures.