In plain words
At home, each device has a private address, valid only inside the house, like an extension number in a company. Towards the internet, the whole household shares a single public address, like the switchboard number. The router acts as the switchboard operator: that is NAT, which replaces the private address with the public one on the way out, and does the reverse on the way back.
This guide follows on from IP address, subnet mask, gateway.
1. Private and public addresses
| Private address | Public address | |
|---|---|---|
| Where it is valid | Only inside the local network | Across the whole internet |
| Uniqueness | The same address exists in millions of homes | Unique worldwide at any given moment |
| Who assigns it | The router (DHCP) | The internet service provider |
| Ranges | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
Everything else, with a few exceptions |
| Reachable from the internet | No, never directly | Yes |
The three private ranges are defined by RFC 1918 (see IP address classes). Internet routers refuse to carry them: a packet addressed to 192.168.1.42 cannot cross the internet, since millions of machines have that address.
2. Why this system exists
There are only about 4.3 billion IPv4 addresses (2³²), far fewer than the number of connected devices. Giving a public address to every phone, computer and smart device is impossible. The solution: one public address per home or company, and private addresses behind it.
3. Seeing both addresses
Your machine's private address is shown by ipconfig (Windows), ip -4 addr (Linux) or networksetup -getinfo Wi-Fi (macOS): see IP address, subnet mask, gateway.
The public address, the one the internet sees, cannot be read on the machine: you have to ask an outside server which address it receives.
Linux and macOS:
curl -4 ifconfig.me
Windows (PowerShell or Command Prompt, curl.exe ships with Windows 10 and 11):
curl.exe -4 ifconfig.me
You can also read it in the router's interface, in the internet connection section (often called "WAN").
4. How NAT works
Take a computer at 192.168.1.42 opening a web page. The router has the public address 203.0.113.10.
On the way out, the router replaces the packet's source address and port, and records the mapping in a translation table:
| Home side (before the router) | Internet side (after the router) | Destination |
|---|---|---|
192.168.1.42 port 51000 |
203.0.113.10 port 62001 |
Web server, port 443 |
192.168.1.57 port 51000 |
203.0.113.10 port 62002 |
Web server, port 443 |
On the way back, the server replies to 203.0.113.10 port 62001. The router looks up its table, finds the matching line and sends the reply to 192.168.1.42 port 51000.
As the second line shows, two machines can use the same source port: the port chosen by the router on the internet side tells them apart. This port-based variant of NAT is called PAT or NAPT; it is the one every home router uses. On Linux, it is called masquerade.
5. The consequence: no entry without an invitation
The translation table only contains connections opened from the inside. When a connection arrives from the internet with no match in the table, the router does not know which machine to send it to: it drops it.
That is why a server installed at home (a NAS, a game server, Home Assistant) cannot be reached from outside by default. There are three solutions:
| Solution | Principle | Recommendation |
|---|---|---|
| Port forwarding (destination NAT) | The router sends everything arriving on a given port to a specific machine: for example port 443 to 192.168.1.20 |
Limit it to the services you need, kept up to date and protected |
| The router's DMZ | Everything arriving without a match is sent to a single machine | Not recommended: the machine is exposed on all its ports |
| VPN (WireGuard…) | You open a single port, the VPN's, and then reach the local network as if you were there | The safest solution for personal use |
NAT is not a firewall
NAT blocks incoming connections as a side effect, not by design. Routers' UPnP feature even lets any device on the network open port forwards by itself, without asking you. Turn it off if you do not need it, and regularly check the list of active forwards.
6. CGNAT: when the provider does NAT too
Running short of IPv4 addresses, some providers no longer give each router a public address, especially on mobile networks (4G, 5G) and some fixed-line plans. They add their own NAT: several customers share the same public address. This is CGNAT (Carrier-Grade NAT).
How to spot it: compare the WAN address shown in the router with the public address given by curl -4 ifconfig.me.
| Router's WAN address | Situation |
|---|---|
| Same as the public address | Dedicated public address: port forwarding works |
In 100.64.0.0/10 (from 100.64.x.x to 100.127.x.x) |
CGNAT: the range reserved for providers (RFC 6598) |
Private address (10.x, 192.168.x…) |
Another router sits in front of yours (double NAT), or CGNAT |
Address shared by port ranges
Some fixed-line providers use a variant: the router's WAN address is indeed public, but it is shared between several customers, and each one only gets a range of ports. Forwarding then works only on the ports in that range, shown in the router's interface.
Consequence of CGNAT: port forwarding is impossible, since the incoming connection is stopped at the provider, before your router. The options: ask the provider for a dedicated public IPv4 (some offer it, sometimes as an add-on), use IPv6, or use a tunnel service that sets up an outgoing connection to the outside.
7. Double NAT
When a personal router (a Wi-Fi router, an OPNsense firewall) is plugged in behind the ISP router without care, every packet is translated twice. The internet works, but port forwarding, some online games and VoIP can run into trouble.
The solutions, in order of preference:
- Switch the ISP router to bridge mode (or "modem mode") if the provider allows it: your router then receives the public address directly.
- Otherwise, put your router in the ISP router's DMZ: everything arriving is passed to your router, which stays in charge of filtering.
- Otherwise, set up port forwarding on both devices.
8. What about IPv6?
IPv6 offers 2¹²⁸ addresses: every device can have a public address, and NAT becomes unnecessary. The flip side: without NAT, nothing blocks incoming connections as a side effect any more. The firewall on the router and on the machines becomes essential. Routers usually configure it to refuse incoming connections by default.
9. Going further: NAT on Linux
A Linux server acting as the router for a private network (a lab, virtual machines) does NAT with nftables. Example: the internal network's machines go out through the eth0 interface.
sudo sysctl -w net.ipv4.ip_forward=1
sudo nft add table ip nat
sudo nft add chain ip nat postrouting '{ type nat hook postrouting priority srcnat ; }'
sudo nft add rule ip nat postrouting oifname "eth0" masquerade
The first line allows the machine to pass packets from one interface to another. These settings are lost on reboot: to keep them, write them to /etc/sysctl.d/ and /etc/nftables.conf.
Key takeaways
- Private address: valid at home, never reachable from the internet. Public address: unique, assigned by the provider.
- The router's NAT replaces the private address with the public one, and keeps a table to send the replies back.
- An incoming connection needs port forwarding or, better, a VPN.
- Router WAN address between
100.64and100.127: you are behind CGNAT, port forwarding is impossible. - NAT is not a firewall: turn off UPnP if you do not need it.