Your router and NAT

Look up your own public IP address, and every device on your home network, phone, laptop, smart speaker, will show the same number. Look at what each device thinks its own address is, and you will find something different: a private address like 192.168.1.12, from the ranges RFC 1918 reserves for local networks, covered in the first lesson of this course. The device that bridges the two is your router, using a technique called Network Address Translation, or NAT.

What NAT actually does

MDN’s glossary defines it plainly: NAT “is a technique for letting multiple computers share an IP address”, by “assigning unique addresses to each computer on the local network and adjusting network traffic to send data to the right place.” Concretely, when your laptop opens a connection to a website, the router rewrites the outgoing packet so it appears to come from the router’s own public address, and keeps a table linking that connection back to your laptop’s private address and port. When the reply arrives, the router looks it up in that table and forwards it to the right device.

This is why NAT exists at all: IPv4’s roughly 4.3 billion addresses were never going to stretch to a public address for every phone, laptop and smart device in every household, and internet providers generally hand a home only one public address. NAT lets a household of a dozen devices share that single address without each one needing its own.

What NAT does for you, incidentally

NAT was built to solve an address shortage, not to secure your network, but it has a useful side effect. Because devices behind it only have private addresses, a computer on the open internet cannot simply open a new, unsolicited connection to your laptop the way it could if your laptop held a public address directly: there is no public address for it to reach, and the router has no matching entry in its translation table to forward that connection to. Traffic your own device requested is let back in because the router remembers the request; traffic nobody asked for generally has nowhere to go.

What NAT does not do

That incidental filtering is not the same as security, and it is worth being precise about the difference:

• NAT does nothing about connections your own devices open outward. If an app on your laptop connects to a server, NAT happily lets the reply back in; it has no opinion on whether that app should have been talking to that server in the first place.
• NAT does not inspect or encrypt content. Anything sent in the clear is just as readable to the sites and networks in between as it would be without NAT.
• NAT is not a substitute for a firewall. Many routers run a stateful firewall alongside NAT, and it is that firewall, tracking the handshake described in the previous lesson, doing the actual job of deciding what to allow.
• Devices sharing one public address can still be told apart individually by other means, such as accounts, cookies or device identifiers used by the sites they visit.

In short: NAT is why your whole household shares one address, and, as a side effect, why random inbound connections generally cannot reach a specific device inside your home uninvited. It says nothing about what your own devices choose to send out, or about anyone downstream of your own outgoing connections.