What is NAT and why do multiple devices share a public IP?

Published on 2026-10-20 by frfrand

NAT explicado con ejemplos: IP pública y privada, traducción de puertos, conexiones salientes, port forwarding y limitaciones de CGNAT.

NAT is a technique that translates network addresses when data passes from one network to another. It is used extensively in homes and offices so that multiple devices with private IP addresses can communicate with the Internet using a shared public address.

Its name comes from Network Address Translation. Although it may sound complex, it explains a very common mystery: how is it possible for five cell phones, a TV, and two laptops to browse at the same time if your provider gave you only one public IP?

The reception of a building

Imagine a building with twenty apartments and a single postal address. From outside, all packages arrive at the same address, but the reception knows which apartment to deliver each one to.

With NAT —and especially with a common variant called NAPT or PAT, which also translates ports—, the router keeps information that allows it to associate the communications of its internal devices with the connections that go out to the Internet.

Each device can have a private IP, such as 192.168.1.10 or 192.168.1.11, while an external connection can see the router's public outgoing IP.

The analogy has limits: connections are not physical mail packages and translation rules depend on protocols and network states.

A step-by-step example

Suppose your laptop has 192.168.1.10 and opens a web page.

1. Your notebook creates a connection to the destination server.
2. The router receives traffic from a private address that is not routed directly over the Internet.
3. A translation function can replace the source IP and, in NAPT, also the port used.
4. The router keeps a temporary association to recognize the response traffic.
5. When the page replies, it uses that association to deliver the response to your notebook.

At the same time, another cell phone can open the same website. The translations and ports allow distinguishing the communications.

NAT is not equivalent to encryption. The router changes addressing information; it does not necessarily protect the content of the data.

Private IP and public IP: what is the difference?

In IPv4, private networks usually use ranges such as 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. Those addresses are not routed directly on the public Internet in the same way as a global IP.

That is why two different houses can both have a computer with 192.168.1.20 without that causing a conflict between their private networks.

The public IP is the one that can be used to communicate with external networks. But careful: not every address you see as "outgoing IP" belongs exclusively to your home.

What is CGNAT and why can it complicate things?

Some Internet providers also perform address translation on their own infrastructure; it is often called CGNAT, or carrier-grade NAT.

That allows several clients to share certain public addresses. If you are behind CGNAT, you may not be able to receive incoming connections to your router as expected, even after configuring local redirects.

Example: you want to host a game server at home. Everything works within your Wi-Fi, but your friends cannot connect from outside. It could be a firewall rule, a misconfigured redirect, or that your connection uses CGNAT.

Before paying for a different service or changing equipment, ask the provider what type of IPv4 connectivity it offers and what alternatives exist.

What is port forwarding?

By default, an incoming connection from the Internet does not have to correspond to an active translation on the router. A port forwarding allows you to indicate to which internal device to send certain new connections.

For example, someone can configure the public port of a service to reach a private machine. This can be useful, but it also exposes that service to external traffic if the network and firewall allow access.

Do not forward a port just because a tutorial tells you "open everything and you're done". First ask yourself if the application really needs public access and how it will authenticate.

Is NAT a firewall?

No. NAT can make certain unsolicited incoming connections difficult due to how translations and states are managed, but it does not replace a firewall nor provide a complete security policy.

A misconfigured application, an incorrect port rule, or vulnerable software remain dangerous. A device can also initiate outbound connections to malicious destinations even if it uses NAT.

Does NAT exist in IPv6?

The need to share a public address does not work the same way in many IPv6 networks, where devices can have their own global addresses. Even so, translation solutions exist in certain IPv6 designs.

The important thing is not to confuse "having a global IP" with "allowing all access." Firewall rules remain relevant.

Where does ArduMaker come in?

In the infrastructure that manages VPS and containers, such as ArduMaker, there are private networks, host addresses, and rules that determine how traffic arrives from the Internet to an application.

Understanding NAT helps to understand why a program can respond inside a container and not from outside, or why publishing a port requires conscious configuration.

The fundamental idea: NAT translates addresses; NAPT can also translate ports to share an exit. It serves to connect networks, not to replace permissions, authentication, or security.

Sources: RFC 3022: Traditional NAT · Private IPv4 Address Ranges, RFC 1918 · Port Forwarding Explained on ArduMaker.