The Big Picture: One Front Door for the Whole House
Your home has a phone, a laptop, a TV, a games console and a desktop, all online. But your Internet provider usually gives your home only one public IP address. How can ten devices share one address and still get their own replies?
Think of a company with one main phone number and an operator at the front desk. Employees inside have internal extension numbers. When an employee calls out, the operator makes the call using the main number and writes down who asked. When the answer comes back to the main number, the operator checks the note and connects it to the right employee.
Your router is that operator. This trick is called NAT.
9.1 Why NAT Exists (Private and Public IP Conservation)
What it is: NAT (Network Address Translation) is a router feature that rewrites the IP addresses (and ports) inside packets as they pass through. The most common kind lets many devices with private addresses share one public address.
The problem it solves: IPv4 shortage. As Section 2 explained, IPv4 has only about 4.3 billion addresses, and there are many more devices than that. Rather than give every phone and TV a public address, the world agreed on private ranges (10/8, 172.16/12, 192.168/16) that anyone can reuse in their own home or company:
| Private address | Public address | |
|---|---|---|
| Example | 192.168.1.25 | 203.0.113.7 |
| Unique in the world? | No. Millions of homes use 192.168.1.x | Yes |
| Reachable from the Internet? | No (routers on the Internet drop it) | Yes |
| Who gives it? | Your own router (DHCP, Section 5) | Your Internet provider |
NAT is the bridge: it lets private addresses reach the public Internet.
A side effect: privacy and a little safety. Because outsiders only see the router's public address, they do not see your devices behind it, and unsolicited incoming traffic has nowhere to go (9.2). But NAT was made to save addresses, not to be a security tool. Firewalls (Section 10) are the real protection.
Other kinds of NAT. You may meet these names:
| Name | Meaning |
|---|---|
| PAT (Port Address Translation), also called NAT overload | Many private addresses share one public address, using port numbers to tell them apart. This is what home routers do |
| Static NAT | One private address always maps to one fixed public address |
| CGNAT (Carrier-Grade NAT) | Your provider does a second layer of NAT, so even your router's "public" address is shared with other customers. It saves addresses but makes incoming connections impossible |
9.2 How Home Routers Use NAT
What it does: The router keeps a NAT table (also called a translation table). Each row remembers one outgoing connection, so the reply can be sent back to the right device.
Outgoing packet (your PC to a web server):
PC 192.168.1.25 ROUTER Web server
sends from port 50123 LAN: 192.168.1.1 93.184.216.34
WAN: 203.0.113.7 (public)
1. 192.168.1.25:50123 ──────► rewrites the source:
to 93.184.216.34:443 203.0.113.7:61001 ─────────► server sees the
and writes a note (below) ROUTER's address
The note it writes (the NAT table):
┌──────────────────────┬────────────────────┬───────────────────────┐
│ Private (inside) │ Public (outside) │ Remote server │
├──────────────────────┼────────────────────┼───────────────────────┤
│ 192.168.1.25:50123 │ 203.0.113.7:61001 │ 93.184.216.34:443 │
│ 192.168.1.40:51500 │ 203.0.113.7:61002 │ 93.184.216.34:443 │
│ 192.168.1.50:49800 │ 203.0.113.7:61003 │ 198.51.100.9:443 │
└──────────────────────┴────────────────────┴───────────────────────┘
Notice: all three devices appear as 203.0.113.7. The port number (61001, 61002, 61003) tells the router which device each reply belongs to.
The reply coming back:
Web server ROUTER PC 192.168.1.25
93.184.216.34:443 ──────► looks up 203.0.113.7:61001 ──────► gets the reply
sends to 203.0.113.7:61001 in its table → 192.168.1.25:50123 on port 50123
The router also fixes the checksums in the headers after it changes them. The PC never knows that anything was rewritten.
Table entries expire. When a connection is closed, or has been silent for a while (seconds to minutes for UDP, longer for TCP), the router deletes the row and the port can be reused.
Why incoming connections are a problem. Imagine someone on the Internet sends a packet to 203.0.113.7:3389. The router looks in its table: no row. It does not know which device should get it, so it drops it. That is NAT's side-effect protection. It is also a problem if you want to run a server at home (a game server, a web server, a camera).
Port forwarding: telling the router a permanent rule. With port forwarding you add a fixed row by hand:
"Anything arriving at my public address on TCP port 25565
goes to 192.168.1.60 port 25565."
| Rule element | Example |
|---|---|
| External port | 25565 |
| Protocol | TCP |
| Internal address | 192.168.1.60 (best to give this device a DHCP reservation, Section 5.1, so the address does not change) |
| Internal port | 25565 |
Safety note. Every forwarded port is a door open to the whole Internet. Only forward what you really need, keep that program updated, and never forward things like Remote Desktop (3389) or file sharing (445) straight to the Internet. A VPN is a safer choice for reaching your home network. Port forwarding is changed in the router's settings page, not in Windows, and this chapter does not change any router settings.
What NAT breaks, and how it is worked around:
| Problem | Why | Workaround |
|---|---|---|
| Cannot host a server from home | No NAT table row for new incoming connections | Port forwarding (when the provider gives a real public address) |
| Peer-to-peer apps, calls, games struggle | Both sides are behind NAT | NAT traversal tricks and relay servers |
| Two layers of NAT (CGNAT) | Provider's NAT blocks incoming traffic | Ask the provider for a public address, or use a VPN or tunnel service |
| Some old protocols put IPs inside the data | NAT rewrites headers but not the data | Special helpers in the router (called ALGs) |
IPv6 and NAT. With IPv6 (Section 2.2) every device can have a public address. Home routers then use a firewall (Section 10) rather than NAT to keep unwanted traffic out.
See it on your own PC (read-only):
ipconfig
Get-NetIPConfiguration
Your PC shows a private address (such as 192.168.1.25). The public address shown for you on the Internet is the router's, not the PC's. You can compare them: the router's status page shows its WAN IP. If the WAN address starts with 100.64 to 100.127, or with a private range, your provider is probably using CGNAT.
Summary
| Topic | Remember this |
|---|---|
| NAT | The router rewrites addresses so many private devices share one public address |
| Why | IPv4 has too few addresses; private ranges can be reused in every home |
| PAT | Uses port numbers to tell connections apart (what home routers do) |
| NAT table | Remembers inside address:port, outside port and the remote server for each connection |
| Incoming traffic | No table row means the packet is dropped, so you need a rule |
| Port forwarding | A fixed rule: public port goes to a chosen inside address and port; use with care |
| CGNAT | The provider's own NAT; blocks incoming connections |
| Not a firewall | NAT hides devices as a side effect, but it was not designed for security |