The address-sharing problem
Your laptop, phone and printer may each have an address on your home network, such as 192.168.1.20. Those are private IPv4 addresses: they are useful inside a local network but are not routed across the public internet. To reach a website, the devices typically send traffic through a router that has, or can reach, a public IPv4 address.
Network Address Translation, or NAT, changes address information in packets as they cross that boundary. In the common home setup, the router translates traffic from several private addresses so it can leave using one public address. This helps conserve public IPv4 addresses, but it also means the router must keep track of which returning packets belong to which local device.
How the router keeps conversations separate
Consider a laptop at 192.168.1.20 opening a connection from source port 53000 to a website on destination port 443. Before forwarding the packet, the router may replace the private source address with its public address, 203.0.113.10, and the source port with 61001. It records a mapping between the original address and port and the translated address and port. The addresses here are examples, not settings to copy.
When the website replies to 203.0.113.10 on port 61001, the router looks up that mapping. It changes the packet’s destination back to 192.168.1.20 on port 53000 and delivers it to the laptop. A phone can contact the same website at the same time because the router gives its traffic a distinct mapping. The port numbers help the router distinguish conversations that otherwise appear to share a public address.
This address-and-port translation is often called PAT, or port address translation, and is the form of NAT most people encounter at home. Mappings are generally temporary. The router creates them as traffic flows and removes them after a connection ends or becomes inactive, with details varying by device and protocol.
Why outgoing traffic is easier than incoming traffic
An outgoing request gives the router a mapping it can use for the reply. An unsolicited incoming packet has no such obvious destination: the public address represents the router and potentially many devices behind it. By default, a typical home router will not know which private address should receive that packet.
Port forwarding is one way to make a particular service reachable. A router can be configured to send traffic arriving on a chosen public port to a specified device and port on the local network. For example, a team might forward an incoming port to a test server. Doing so exposes that service to traffic from outside, so the service still needs appropriate access controls and updates.
Some applications use other techniques to establish connections through NAT, and some routers support automatic mapping requests from local devices. Those approaches depend on the network and its configuration; NAT does not guarantee that every peer-to-peer application or self-hosted service will work without adjustment.
NAT is not a substitute for a firewall
Because unsolicited inbound traffic often cannot reach a device without a mapping, NAT may appear to act like a security feature. Its main purpose in this setup, however, is translation and address sharing. A firewall makes separate decisions about which traffic to allow or block. Many home routers provide both functions, which can make their effects easy to confuse.
NAT also does not hide what a device does from every party on the internet. External services can see the public address used by the connection, while traffic contents and other identifying information depend on the application and its protections. Treat NAT as one part of network design, not as a replacement for secure software, sensible firewall rules or encrypted connections.
When the public address is not on your router
Sometimes an internet provider uses carrier-grade NAT, placing another translation layer between your router and the public internet. Your router then receives an address that is not a directly reachable public IPv4 address. Ordinary outbound browsing can still work, but a port-forwarding rule on your own router may not be enough to accept inbound connections.
If a self-hosted service is unreachable, check the router’s internet-facing address and compare it with the public address seen by an external service. A mismatch can be a clue, though other network arrangements can also explain it. IPv6 offers a different addressing model: devices can have globally routable addresses without sharing one IPv4 address through NAT. That does not mean inbound access is automatically permitted—firewall rules and application configuration still matter.
