NAT and port translation
Your home has many devices but only one public IPv4 address. Follow a laptop and a phone as the router swaps their private addresses (192.168.1.10, 192.168.1.11) for its public one (203.0.113.7), gives each conversation its own public port, and swaps the replies back. Then see why a stranger's packet gets dropped.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01The laptop sends from 192.168.1.10:50000. What source does the server see?
The router swaps in its public address and a public port it picked. The private address never leaves the home.
02The laptop and the phone both use source port 50000. How does the router know which device a reply is for?
That is port translation (NAPT, or PAT): the public port is the key into the translation table.
03A stranger sends a packet to 203.0.113.7:8080, and no row matches. What happens?
With no row, the router has nowhere to send it. Port forwarding adds a fixed row by hand so a home server can be reached.
04Why do translation table rows expire?
Rows for idle conversations are removed: at least 2 minutes for UDP (RFC 4787) and at least 2 hours 4 minutes for an open TCP connection (RFC 5382).
05Why does NAT exist at all?
Sharing one public address stretches the IPv4 supply. IPv6 has enough addresses for every device, so it does not need NAT.
Glossary
- NAT
- Network address translation: a router rewrites addresses in packets as they pass, so many private devices can share one public address.
- NAPT / PAT
- NAT that rewrites the port number as well as the address, so one public address can carry many conversations at once.
- Private address
- An address from the ranges set aside by RFC 1918 (10/8, 172.16/12, 192.168/16). They work inside a network but are never routed on the internet.
- Public address
- An address that is unique on the internet and can be reached from anywhere, like the router's 203.0.113.7 here.
- Port
- A number from 0 to 65535 that names one app's endpoint on a device, so many apps can share one address. An address plus a port on each end names one conversation.
- Translation table
- The router's list of rows, each pairing an inside address and port with the public port it was given.
- Port forwarding
- A fixed row you add by hand, so packets arriving at a chosen public port reach a device inside the home.
Notes and sources
- 203.0.113.7, 198.51.100.20 and 192.0.2.99 are RFC 5737 documentation addresses; 192.168.1.0/24 is RFC 1918 private space. Port numbers are illustrative.
- Many routers keep the inside port when it is free (port preservation, RFC 4787 §4.2.1). Here the router hands out 61001, 61002, … so the swap is easy to see.
- Real routers also note the server’s address and port in each row and may accept replies only from it (RFC 4787 §5).
- Some internet providers add a second NAT of their own (carrier-grade NAT, RFC 6888), so even the “public” address on your router may be shared.
Quiz Unlocks after the last step.