Your house has one public IP from your ISP. But you might have 20+ devices using the internet — phones, laptops, smart bulbs, doorbells, TVs. Network Address Translation is the trick that makes this work. Here's the mechanism, in plain English.

The problem NAT solves

Each public-internet conversation needs a unique source IP and source port. With only 4.3 billion IPv4 addresses, giving every device its own public IP isn't possible. NAT lets one public IP represent many private devices by tracking which device started each conversation.

How it works (the short version)

1. Your phone (private IP 192.168.1.50) opens a connection to a website on port 443.
2. The router rewrites the source IP to its public IP and assigns a unique source port for this conversation.
3. The router stores a mapping in its NAT table: (public IP, port 50001) ↔ (192.168.1.50, port 53412).
4. The website's reply comes back to (public IP, port 50001). The router checks the table and forwards it to your phone.

Why it acts like a firewall (sort of)

Inbound traffic that doesn't match an existing entry in the NAT table has nowhere to go — the router drops it. So uninvited connections from the internet can't reach devices in your home. This is a side effect, not a real firewall, but it's a meaningful security boundary.

Port forwarding: making exceptions

To run a server (game host, security camera, home web server) you tell the router "any traffic arriving on port X, send it to private IP Y." That's a permanent NAT entry you control. Be careful — once a port is forwarded, that device is exposed to the internet.

Carrier-grade NAT (CGN)

Mobile carriers and some ISPs put many customers behind one public IP using a second layer of NAT. That's why two phones on the same carrier often appear to come from the same IP. It also breaks port forwarding entirely — you can't host services from behind CGN.

Try it now

Curious what your IP is showing the world right now? Check your IP address & location instantly with our free tool — no signup, nothing stored. Or trace any other IP to see its geolocation, ISP, and network details.