What is NAT?

How Network Address Translation Affects DNS Filtering

NAT (Network Address Translation) is a router function that maps private internal IP addresses to a single public IP address. NAT is transparent to DNS filtering — CleanBrowsing uses your public IP for profile matching.

Why Public IP Matters

Step 1: What is NAT?

Network Address Translation (NAT) is a technique used by routers to translate private IP addresses (like 192.168.1.x) into a single public IP address when communicating with the internet.

NAT was developed to conserve IPv4 addresses. Without NAT, every device on your network would need its own public IP. With NAT, dozens or hundreds of devices can share one public IP address — the router keeps track of which internal device each connection belongs to.

Step 2: How NAT Works

  • Outbound translation: When a device sends traffic to the internet, the router replaces the private source IP with the public IP and records the mapping
  • Inbound translation: When a response comes back, the router uses its mapping table to forward the traffic to the correct internal device
  • Port tracking: NAT uses port numbers to distinguish between connections from different internal devices sharing the same public IP
  • Transparent operation: Devices on the network don't need to know about NAT — it operates automatically at the router level

Step 3: NAT and DNS Filtering

NAT is transparent to DNS filtering. When your devices send DNS queries to CleanBrowsing, those queries arrive from your public IP — regardless of which internal device originated them.

This means all devices behind NAT share the same filter profile when using network-level DNS filtering. To apply different filtering rules to different devices, you can use device-level deployment with encrypted DNS (DoH/DoT) and different profile credentials per device.

Step 4: CGNAT — NAT at ISP Scale

Carrier-Grade NAT (CGNAT) takes NAT a step further — ISPs apply NAT at their level, meaning multiple customers share a single public IP. This creates challenges for DNS filtering because CleanBrowsing can't distinguish between different households sharing the same public IP.

Solutions for CGNAT environments include using encrypted DNS with per-device credentials or deploying via MDM solutions like Intune or Mosyle.

IPv6 eliminates the need for NAT entirely by providing enough addresses for every device. On the authoritative DNS side, NOC.org supports both IPv4 and IPv6 DNS records.

Understand your public IP for DNS filtering

Why Public IP Matters