NAT
How a whole household of devices shares one public IP address
There are not enough IPv4 addresses for every device on Earth. NAT is the clever workaround that lets an entire home or office — dozens of devices — share a single public IP. It runs silently in every router you own.
Interactive — NAT: one IP, many devices
animated figureWatch the router rewrite private sources to its public IP, keep a translation table, route every reply home — and drop the packet nobody asked for.
Every device has a private 192.168.1.x address. The internet only ever sees one IP: 203.0.113.5.
Why NAT exists
IPv4 has only ~4.3 billion addresses — far fewer than the number of devices. NAT (Network Address Translation) lets many devices on a private network share one public IP, dramatically stretching the address space. It is a big reason IPv4 is still around.
Private IP ranges
Certain address ranges are reserved for private networks and are never routed on the public internet:
- 10.0.0.0/8
- Large networks (16 million addresses).
- 172.16.0.0/12
- Medium networks.
- 192.168.0.0/16
- Home and small office (the classic 192.168.x.x).
Translating the address
When a device sends a packet out, its source is a private IP (like 192.168.1.5) that the internet cannot route back to. So the router rewrites the source to its own public IP on the way out — and reverses the swap on the way back. That rewrite is NAT.
The NAT table
To send replies back to the right device, the router keeps a NAT table mapping each connection: private IP:port ↔ public IP:port. Ports are the key — they let the router tell apart connections that would otherwise look identical. Because ports do the disambiguating, this common form is called PAT (Port Address Translation).
Many devices, one IP
Thanks to ports, dozens of devices can share a single public IP simultaneously. Each active connection gets a unique public port, so the router always knows which internal device a returning packet belongs to. This many-to-one mapping is what makes home networking work.
The inbound problem
NAT makes outbound easy but inbound hard: an unsolicited request from the internet has no NAT-table entry, so the router does not know which device to give it to — and drops it. (This is a handy side-effect for security.) To host a server behind NAT, you add a port-forwarding rule that maps a public port to a specific internal device.
Wrap-up: That completes the roadmap the introduction promised — from IP addressing all the way up to HTTP, TLS, and the protocols that run your network.