hop 14 of 32 · 5 min

Many devices, one public address

There are about 4.3 billion IPv4 addresses and far more devices. Network address translation is why the internet kept working anyway.

Private ranges

Three blocks are reserved for internal use and are never routed on the public internet:

code

10.0.0.0/8         16.7 million addresses
172.16.0.0/12       1 million
192.168.0.0/16     65,536

Every home router uses one. The same 192.168.1.10 exists in millions of houses, and no conflict arises because those addresses never leave the house.

How translation works

The router rewrites the source address and port on the way out, and remembers the mapping:

code

outbound  192.168.1.50:51234  ->  203.0.113.7:40001
inbound   203.0.113.7:40001   ->  192.168.1.50:51234

The port is the part doing the work. One public address multiplexes thousands of simultaneous connections because each gets a distinct port, which is why this is properly called port address translation.

What it breaks

Incoming connections. Nothing outside can start a connection to a device behind NAT, because there is no mapping until the inside sends something first. Port forwarding is the manual workaround.

Peer to peer. Two devices both behind NAT cannot reach each other directly. The workarounds are an industry: STUN to discover your public mapping, TURN to relay through a server when that fails, ICE to try the options in order. Every video call application implements all three.

Protocols carrying addresses in the payload. Anything that mentions its own IP inside the data is broken by NAT, because the address was rewritten in the header and not in the body. FTP in active mode and SIP both need special handling in the router for this reason.

End to end addressing. A design principle of the internet was that any host could address any other. NAT ended that, and much of the complexity of modern networking follows from it.

	Benefit	Cost
Address reuse	extended IPv4 by decades	none directly
Nothing reachable inbound	looks like a firewall	breaks peer to peer
Rewriting	invisible to most traffic	breaks address carrying protocols

Not a security feature

NAT is often described as one. It does block unsolicited inbound connections, which is genuinely useful, and it does nothing about anything else: a device that initiates an outbound connection to a malicious server is unaffected, and most compromises work exactly that way.