A method for network address translation, NAT, applied in a scenario where a virtual machine, VM, is migrated across data centers and comprising: receiving (101, 207), by a NAT control apparatus, a network address migration message after a first data center migrates a NAT mapping entry corresponding to a migrated VM to a second data center, and verifying the network address migration message, wherein the network address migration message carries the NAT mapping entry, and the NAT mapping entry records a mapping between a private network address and a public network address of the VM; and updating (102, 210) home information of the NAT mapping entry in a network address mapping table from the first data center to the second data center according to the network address migration message after the NAT control apparatus successfully verifies the network address migration message, wherein the network address mapping table is used to record the NAT mapping entry and the home information of the NAT mapping entry; wherein: the receiving, by a NAT control apparatus, a network address migration message comprises: receiving, by the NAT control apparatus, the network address migration message sent by the first data center; and the verifying the network address migration message comprises: sending by the NAT control apparatus a verification request message to the second data center and receiving by the NAT control apparatus a verification response message from the second data center after confirming that the NAT mapping entry is migrated to the second data center; or the receiving, by a NAT control apparatus, a network address migration message specifically is: receiving, by the NAT control apparatus, the network address migration message sent by the second data center; and the verifying the network address migration message specifically is: sending by the NAT control apparatus a verification request message to the first data center and receiving by the NAT control apparatus a verification response message from the first data center after confirming that the NAT mapping entry is migrated out of the first data center. receiving (101, 207), by a NAT control apparatus, a network address migration message after a first data center migrates a NAT mapping entry corresponding to a migrated VM to a second data center, and verifying the network address migration message, wherein the network address migration message carries the NAT mapping entry, and the NAT mapping entry records a mapping between a private network address and a public network address of the VM; and updating (102, 210) home information of the NAT mapping entry in a network address mapping table from the first data center to the second data center according to the network address migration message after the NAT control apparatus successfully verifies the network address migration message, wherein the network address mapping table is used to record the NAT mapping entry and the home information of the NAT mapping entry; wherein: the receiving, by a NAT control apparatus, a network address migration message comprises: receiving, by the NAT control apparatus, the network address migration message sent by the first data center; and the verifying the network address migration message comprises: sending by the NAT control apparatus a verification request message to the second data center and receiving by the NAT control apparatus a verification response message from the second data center after confirming that the NAT mapping entry is migrated to the second data center; or the receiving, by a NAT control apparatus, a network address migration message specifically is: receiving, by the NAT control apparatus, the network address migration message sent by the second data center; and the verifying the network address migration message specifically is: sending by the NAT control apparatus a verification request message to the first data center and receiving by the NAT control apparatus a verification response message from the first data center after confirming that the NAT mapping entry is migrated out of the first data center. the receiving, by a NAT control apparatus, a network address migration message comprises: receiving, by the NAT control apparatus, the network address migration message sent by the first data center; and the verifying the network address migration message comprises: sending by the NAT control apparatus a verification request message to the second data center and receiving by the NAT control apparatus a verification response message from the second data center after confirming that the NAT mapping entry is migrated to the second data center; or the receiving, by a NAT control apparatus, a network address migration message specifically is: receiving, by the NAT control apparatus, the network address migration message sent by the second data center; and the verifying the network address migration message specifically is: sending by the NAT control apparatus a verification request message to the first data center and receiving by the NAT control apparatus a verification response message from the first data center after confirming that the NAT mapping entry is migrated out of the first data center.