Your laptop, phone, TV and games console can all reach the internet at the same time, yet the outside world sees just one address for your home. The trick behind that is NAT, and it's also the reason a game server, security camera or home server you set up can't be reached from outside until you add a port forward. This post explains the mechanism. If you already understand it and want the safe, step-by-step setup, go to how to set up port forwarding without exposing your network.
NAT stands for network address translation. At home, your router has two sides:
Private addresses can't be routed on the internet (see private IP address ranges for which ones those are). So when your laptop sends a packet out, the router rewrites the source address to its own public one before forwarding it. When the reply comes back, the router rewrites the destination back to your laptop's private address and hands it over.
What makes this work for a whole household is that the router also tracks ports. Strictly this is called NAPT or PAT, but almost everyone just says NAT. The router keeps a translation table like this:
| Inside | Outside (public) | Remote server |
|---|---|---|
| 192.168.1.20:52100 | 203.0.113.7:40001 | 198.51.100.10:443 |
| 192.168.1.35:52100 | 203.0.113.7:40002 | 198.51.100.10:443 |
Two devices happened to pick the same source port, 52100, and are talking to the same server. The router tells them apart by giving each a different public port. When a reply arrives at 203.0.113.7:40002, the table says it belongs to 192.168.1.35.
Entries are created automatically when a device starts a connection, and they expire after a period of inactivity. You never see the table, but it's doing work every time you load a page.
Now flip the direction. Someone on the internet tries to connect to 203.0.113.7 on port 25565, because you're running a Minecraft server on 192.168.1.50.
The packet arrives at the router. The router looks in its table for an entry matching port 25565 and finds nothing, because nobody inside started that conversation. It has no idea which of your devices, if any, the packet is for. So it drops it.
That's the heart of it. NAT handles traffic that starts inside automatically. It has no way to handle traffic that starts outside, unless you tell it what to do.
This behaviour has a side effect people often mistake for security: devices behind NAT aren't directly reachable from the internet by default. It does help, but NAT isn't a firewall. It doesn't inspect anything, it doesn't protect you from malicious traffic your own devices request, and it offers no protection on IPv6, where there's usually no NAT at all. Most routers pair NAT with a real stateful firewall, and that's what should be doing the protecting.
A port forward is a rule you add to the router that says: "anything arriving on public port X, send to this private address on port Y."
External port 25565/TCP -> 192.168.1.50:25565Now when that incoming packet arrives, the router has an answer, and your server receives the connection. A few consequences follow directly from how it works:
Adding rules by hand is a chore, so protocols exist to let devices ask the router for forwards themselves. UPnP (specifically its Internet Gateway Device profile) is the one most home routers support. NAT-PMP, from Apple, and its successor PCP (RFC 6887) do the same job more simply.
That's why a games console can report "NAT type: open" without you touching the router: it asked for its own port mappings.
The catch is that most home UPnP implementations don't authenticate anything. Any program on any device on your LAN can open a port to the internet, including malware or a cheap camera with poor firmware. The security side of that, and why I'd turn UPnP off on most networks, is covered in the practical port forwarding guide.
Carrier-grade NAT (CGNAT). Many ISPs, especially mobile and some fibre providers, put customers behind a second NAT of their own, sharing one public address across many homes. Your router's WAN address is then private, often in 100.64.0.0/10. You can forward ports on your router all day, but the ISP's NAT has no forwarding rule, so the traffic never reaches you. Compare your router's WAN address with the address our IP lookup reports: if they differ, there's another NAT upstream. The fixes are asking the ISP for a public IPv4 address, using IPv6, or using an overlay VPN that doesn't need inbound ports.
Double NAT at home. An ISP modem-router with your own router plugged in behind it gives you two NATs you do control. Either forward on both, or put the ISP device in bridge or modem mode so only one does NAT.
NAT loopback (hairpinning). Some routers can't handle a device inside your network connecting to your own public address. The forward works fine from outside, but testing from your own Wi-Fi fails. This is why you should always test from outside.
IPv6. With IPv6 each device usually has its own public address, so there's no translation and no "forward" in the NAT sense. You still need a firewall rule allowing the inbound connection to that device, often called a pinhole. Same idea, less rewriting.
The only test that means anything is one from outside your network. Our port scanner connects to your public address from the internet and tells you whether common TCP ports are open, closed or filtered. How to check if a port is open explains what each result means.
No. NAT drops unsolicited inbound traffic as a side effect of not knowing where to send it, which gives some protection, but it doesn't filter or inspect. Your router's firewall does that, and on IPv6 it's the only thing standing between your devices and inbound connections.
Your router probably doesn't support NAT loopback. Connections from inside to your own public IP don't get translated back in. The forward itself is fine.
Usually not. Most games work through NAT because your console starts the connection. Forwarding, or UPnP, mainly helps when you host a game or voice chat that others connect to directly.
A normal commercial VPN usually makes it harder, because you're now behind the VPN provider's NAT. A self-hosted or mesh VPN helps in a different way: it lets your own devices reach home without forwarding anything to the public internet.
0 comments
No comments yet. Be the first.