NAT

NAT (Network Address Translation) rewrites the private IP addresses of devices on an internal network into a single public IP address whenever traffic heads out to the internet. That lets many devices share one public address behind a single internet connection, instead of each device needing its own. This is usually handled by the router or firewall at the edge of the network.

In practice, NAT shows up as internal devices using private address ranges such as 192.168.x.x or 10.x.x.x, while only one public address is visible to the internet for the whole business. The router keeps a table of which internal address and port belongs to which active connection, and uses it to route replies from the internet back to the correct device. This works reliably for connections that are initiated from inside the network.

It gets trickier when a device inside the network needs to be reachable from outside — a server, for example — which requires an explicit rule, port forwarding, since the router otherwise has no way of knowing which internal device incoming traffic is meant for. A common misconception is treating NAT as a security feature: NAT hides internal addresses, but it doesn't replace firewall rules.