Understand NAT and port translation

Network Address Translation, or NAT, rewrites address information as packets cross a boundary. It exists because IPv4 ran out of addresses: your provider gives your home one public address, but your home contains a dozen devices. Home routers commonly translate many private IPv4 clients to one public IPv4 address.

You can see both sides of your own NAT in ten seconds:

ip -4 address show wlan0 | grep inet
# inet 192.168.1.20/24 ...

curl https://ifconfig.me
# 93.41.227.140

Your machine believes it is 192.168.1.20. The rest of the Internet sees 93.41.227.140. Those are different because your router rewrote the source address of every packet on the way out. Everyone in your house gets the same answer from ifconfig.me.

Port translation keeps connections apart

If five devices share one public address, how do replies find the right device? Port translation keeps the connections distinct. The router records a mapping between an internal address and port and an external address and port, then reverses the mapping for reply traffic:

inside                     outside
192.168.1.20:55102   <->   93.41.227.140:40311
192.168.1.31:49220   <->   93.41.227.140:40312

When a reply arrives at 93.41.227.140:40311, the router looks up the table, rewrites the destination back to 192.168.1.20:55102, and forwards it inward. The server at the far end never learns your private address existed.

Consequences you’ll run into

This state explains why a new inbound connection usually has no destination mapping unless you configure port forwarding. Someone connecting to 93.41.227.140:8080 from outside hits a router with no table entry for that port — there’s nowhere to send the packet. Port forwarding is you manually adding the missing row: “port 8080 always goes to 192.168.1.20.”

It also explains why idle mappings can expire. The table isn’t infinite, so mappings for quiet connections get dropped. Long-lived idle connections — SSH sessions, database connections — die mysteriously after minutes of silence for exactly this reason. Keepalive packets exist to refresh the mapping before it expires.

NAT is not a firewall

NAT changes addresses; a firewall enforces policy. They often run on the same device, and unsolicited inbound traffic does fail by default behind NAT, which feels like protection. But NAT is not a substitute for explicit firewall rules or host security. A forwarded port, a UPnP request from any device on your LAN, or a compromised machine inside the network all bypass that accidental protection. Treat NAT as address plumbing and keep real security controls in place.