One public IP, many devices
NAT (Network Address Translation) is how your entire household — laptops, phones, TV, IoT — shares a single public IP address. Your router sits at the boundary between your private network and the internet, translating addresses on the way out and back in. Without NAT, every device would need its own public IPv4 — and we ran out of those years ago.
The translation, step by step
- Your laptop (
192.168.1.42) wants to fetch a webpage. It sends a packet:
from 192.168.1.42:52847 to 93.184.216.34:443 - Your router rewrites the source: it picks an unused port (say 30001) on the public IP and remembers the mapping.
from [your-public-IP]:30001 to 93.184.216.34:443 - The server replies to your public IP, port 30001.
- The router looks up its NAT table: "port 30001 belongs to 192.168.1.42:52847."
- The router rewrites the destination back to your laptop and forwards the packet.
PAT — what your home router really does
Most consumer routers don't do classical NAT (one private IP ↔ one public IP). They do PAT (Port Address Translation, also called "NAT overload" or "masquerading"): the router uses different public-side ports to multiplex many private devices onto one public IP. The mapping table holds both private IP and private port, keyed by the public port.
Why outside connections to home are hard
NAT only naturally handles outbound connections. If you're at a coffee shop and try to reach your home server's private IP, the coffee shop has no path. Your home router has the public IP, but it doesn't know which internal device an unsolicited inbound packet is for. Three escape hatches exist:
- Port forwarding — "Incoming on public port 22 → forward to 192.168.1.100:22." Works, but exposes a service to the open internet.
- UPnP — Auto-port-forwarding by request from inside. Convenient, frequently insecure, usually disable it.
- VPN / Tailscale / WireGuard — Build an encrypted tunnel that bypasses NAT entirely. Track 6.