Sharing One Address Among Many

Network Address Translation (NAT) is the trick that bought IPv4 another few decades of life. Instead of giving every device a globally routable address, a NAT router lets an entire private network share a single public IP by rewriting addresses (and ports) as packets cross the boundary.

How NAT Works

When a device at 192.168.1.20:41230 sends a packet to the internet, the router rewrites the source to its own public IP and a unique source port, e.g. 203.0.113.7:60123, and records the mapping in its NAT table:

192.168.1.20:41230  <-->  203.0.113.7:60123  <-->  142.250.72.14:443

When a reply returns to 203.0.113.7:60123, the router looks up the mapping and forwards it back to the internal host. This specific form, where ports are used to distinguish flows, is technically PAT (Port Address Translation) or NAT overload, and it is what home routers actually do.

The NAT Table and Exhaustion

The NAT table is finite. Each active connection consumes one public port. A busy network of hundreds of devices can theoretically exhaust its port range, though 65,535 ports per public IP usually suffices. Mapping entries expire after an idle timeout (often minutes for TCP, seconds for UDP), which is why NAT can kill long-idle connections—a frequent cause of mysterious timeouts in chat and game clients.

Inbound Traffic: Port Forwarding

NAT naturally blocks inbound connections: there is no mapping for an unsolicited packet from the internet, so the router drops it. To expose an internal service (a game server, a webcam, an SSH box), you configure a port forwarding rule: "any traffic arriving on public port 8080, forward to 192.168.1.50:80." This is the home-lab equivalent of a cloud load balancer's target group.

  • Static forward: always map a fixed public port to a fixed internal host.
  • Trigger/UPnP: applications request mappings dynamically. Convenient, but a security risk if not controlled.
  • DMZ host: forward all unhandled inbound ports to one internal host. Convenient and dangerous—only for a host you intend to expose completely.

CGNAT

As IPv4 addresses became genuinely scarce, carriers began deploying Carrier-Grade NAT (CGNAT): another NAT layer inside the ISP. Your "public" IP is now shared among many subscribers. CGNAT makes inbound hosting impossible without special arrangements, breaks some peer-to-peer protocols, and inflates the request rate that any single IP appears to generate—which is why residential proxies from cellular or CGNAT customers can look suspicious to anti-bot systems.

Security Implications

NAT provides a crude but effective default-deny for inbound traffic. That is not a substitute for a firewall, but it is why so many home devices get away with minimal hardening: they are simply unreachable from outside. When moving to IPv6 with globally routable addresses, that accidental protection disappears—which is why stateful firewalls are mandatory on IPv6 networks.

NAT and Application Protocols

Some protocols embed IP addresses inside the application payload, not just the packet headers. FTP's active mode, SIP, and older VoIP protocols negotiate addresses inside their control messages. NAT rewrites the packet headers but cannot see or fix the addresses buried in the payload, so these protocols break unless a specialized ALG (Application Layer Gateway) intercepts and rewrites them. Modern practice avoids ALGs by using protocols that do not embed addresses (passive FTP, ICE for VoIP) or by tunneling everything over HTTPS.

Hairpinning

A common home/office annoyance: a device inside the network tries to reach another internal service using the public address. The router forwards the packet outbound, but the reply comes back to the widely reachable address and the internal host cannot route it. This NAT hairpin problem is why some services work from outside but not from within the same LAN. Enabling hairpin NAT or using split-horizon DNS (mapping the public name to the internal IP internally) resolves it.

Port Forwarding vs. Reverse Tunnels

Port forwarding requires a stable public IP and open inbound ports—increasingly unavailable under CGNAT. The modern alternative is a reverse tunnel: the internal service dials out to a relay server and keeps a connection open, so inbound requests arrive through the established outbound tunnel (the same technique used by ngrok, Cloudflare Tunnel, and Tailscale). This sidesteps NAT entirely and is more secure because no inbound port is exposed.