NAT (Network Address Translation)
PCIComplianceHubLast updated
A technique used to map one IP address space to another, often used to enable private IP addresses to communicate over the public internet. NAT can play a role in network security by hiding internal IP addresses and is sometimes used within the context of PCI DSS to protect cardholder data environments.
Applies to. NAT runs on the NSC or router at a network boundary and rewrites source or destination addresses as packets cross it. In PCI DSS it is relevant to 1.4.5, which limits disclosure of internal IP addresses and routing information to authorised parties; the guidance to that control lists IPv4 NAT first among the methods of obscuring internal addressing. NAT is also what lets a CDE use private address space that is not routable from the internet.
Example. A merchant's back-office network uses private addresses. Outbound connections from the payment application to the acquirer leave through the edge firewall, which swaps the internal source address for the firewall's public address. The acquirer sees one public address and the internal layout stays hidden, which supports 1.4.5. The firewall still needs an explicit outbound rule for that connection under 1.3.2; NAT does not grant the traffic, it only rewrites it.
Limits. NAT hides addresses; it does not filter traffic. A NAT rule that forwards a public port to an internal server is an inbound path and needs the same justification and deny-by-default treatment as any other rule under 1.3.1 and 1.4.2. NAT is not encryption and does nothing for cardholder data in transit. And it is not the only way to meet 1.4.5, which is about limiting disclosure; NAT is one method, not a mandated one.
In PCI DSS v4.0.1. 1.4.5