NAT: how many devices share one internet address

The problem

There aren't enough public IPv4 addresses for every device in the world. So homes and offices use private addresses inside, and share a small number of public addresses to reach the internet.

How NAT works

1. Your laptop (192.168.1.20) asks for a website.
2. The router swaps the private source address for its own public address and notes the connection in a table.
3. The website replies to the public address.
4. The router checks its table and passes the reply back to your laptop.

Most routers use PAT (port address translation, also called "NAT overload"), which uses port numbers to keep thousands of connections apart on one public address.

Port forwarding

NAT normally blocks unsolicited traffic from the internet, because the router doesn't know which inside device it's for. Port forwarding is a rule that says "send traffic arriving on port X to this inside device", for example to reach a camera recorder from outside.

Security tip: avoid forwarding ports for cameras, remote desktop or admin pages. Use a VPN instead. Exposed devices are scanned and attacked constantly.

Is NAT a firewall?

Not really. It hides inside addresses and blocks unsolicited connections as a side effect, but it doesn't inspect traffic or enforce security rules. You still need a proper firewall.

Real-world example: a whole school behind one address

A secondary school might have hundreds of pupils and staff online at once, yet the whole site may reach the internet through just one or a handful of public addresses. Inside, every laptop has a private address; at the edge, the firewall performs NAT and keeps a table of thousands of conversations, kept apart by port numbers.

This has a side effect that surprises people. To the outside world, every user in the school looks like the same visitor. If one pupil keeps entering wrong passwords on a website, that site may temporarily block the school's address, and suddenly nobody in the building can use it. The same can happen with "too many requests" messages or extra security checks on a busy café's Wi-Fi.

Try this: compare the address from ipconfig with the address shown when you search the web for "what is my IP". The first is your private extension; the second is the shared public number your router uses.