1. The Story
Press "Next" to go through it step by step. At each step a character appears and explains what they are doing.
Prologue: A quick recap
Step 1 of 12
Private IPs cannot go out
Devices at home use Private IPs, such as 192.168.1.10. Countless homes around the world use the same addresses, so Routers on the Internet will not forward packets addressed to 192.168.x.x. The home has only one Public IP: my outside address, 203.0.113.1.
Animation text version (all steps)
- Prologue: A quick recap
- Private IPs cannot go out · Rue: Devices at home use Private IPs, such as
192.168.1.10. Countless homes around the world use the same addresses, so Routers on the Internet will not forward packets addressed to192.168.x.x. The home has only one Public IP: my outside address,203.0.113.1.- More details: Lesson 8, "Who Gives Me an Address? DHCP and NAT"
- Act 1: Everyone goes out together
- Mac sets off · Pip: Mac opens
example.com. My sender is192.168.1.10:50000and my recipient is192.0.2.80:443. If I go out like this, the reply will never find its way back! - The office rewrites the sender · Rue: Leave it to me! I change the sender to my own
203.0.113.1, change the Port to40001as well, and write it down in the NAT Table. This is called NAT (Network Address Translation).- NAT Table:
192.168.1.10:50000↔203.0.113.1:40001
- The TV goes online too · Rue: The TV connects to
example.comat the same time, and it happens to use Port50000too. No problem: I change it to203.0.113.1:40002. One Public IP, with different Ports telling different devices apart.- NAT Table:
192.168.1.10:50000↔203.0.113.1:40001192.168.1.11:50000↔203.0.113.1:40002- Rewriting the Port as well is called PAT (Port Address Translation)
- Replies go to the right resident · Rue: The server's reply is sent to
203.0.113.1:40001. I check the NAT Table:40001belongs to Mac! So I change the recipient back to192.168.1.10:50000and hand it to Mac. - Unknown letters are not accepted · Rue: A packet arrives for
203.0.113.1:40005, but there is no entry for it in the NAT Table. I do not know who to give it to, so I have to drop it. This is a side effect of NAT, but it is not real security.- Real gatekeeping is the job of a Firewall (Story 19)
- Act 2: Connecting home from outside
- Mac at the café · Mac: I'm at a coffee shop and want to look at the photo server on the desktop PC at home (
192.168.1.12:8080). All I know is my home's Public IP, so I connect to203.0.113.1:8080.- The café Router does NAT too: the sender
192.168.0.23becomes198.51.100.1
- The café Router does NAT too: the sender
- Rue does not know who gets it · Rue: This packet is not a reply, so there is no entry in the NAT Table. There are three devices at home and I do not know who
8080is for, so I have to drop it. - Setting up Port Forwarding · Mac: Back home, I add a rule on Rue's settings page: "TCP packets sent to
8080go to192.168.1.12:8080." This is called Port Forwarding. It is like telling the building office to pass on letters for a certain mailbox for me. - Connected home! · Pip: Mac tries again. Following the rule, Rue changes the recipient to
192.168.1.12:8080and hands it to the desktop PC. The photo server's reply travels back along the same path to the coffee shop too! - A door is open: be careful · Rue: Port Forwarding is like opening a door in the building's outside wall. The whole world can come and knock on
8080. Only open the Ports you really need, use strong passwords and keep software up to date. A safer way is to use a VPN (Virtual Private Network), which Story 18 explains. - Summary: The building office · Rue: Going out, NAT changes the sender to the Public IP and uses the NAT Table to remember who is who. Coming back, it checks the table and passes things on. For someone outside to connect home on their own, you need to set up Port Forwarding. That is the end of Part 2. Next stop: transport and services!
2. Where Is the Problem
Mac, the TV and the desktop computer at home all use Private IPs. A Private IP is an address used only inside the home LAN (Local Area Network), such as 192.168.1.10.
Countless homes around the world all use 192.168.1.10. If Pip heads out with that as the sender, where should the server send its reply? Nobody knows. That is why Routers on the Internet simply do not forward packets addressed to 192.168.x.x.
But an ISP (Internet Service Provider) usually gives each home just one Public IP, an address that can be reached directly on the Internet. Here it is Rue's outside address, 203.0.113.1.
So we have two problems:
- How can several devices in the family share one Public IP to go out, without replies going to the wrong person?
- When Mac is out and wants to connect back to a computer at home, how does Rue know who to hand it to?
3. How the Network Solves It
Picture an apartment building. When a resident sends a letter, the building office changes the sender to "building address + a mailbox number" and writes in its book "this mailbox number belongs to that flat". When a reply arrives at the building, the office checks the book and knows exactly who to give it to.
That is NAT (Network Address Translation): the Router rewrites the Private IP as its own Public IP and records it in the NAT Table. Home Routers also rewrite the Port number, which is the number that says which program a packet is for. Strictly speaking, this is called PAT (Port Address Translation).
If someone outside wants to reach a particular flat on their own initiative, the office must be told in advance: "Letters to this mailbox go to so-and-so." This is called Port Forwarding.
4. A Closer Look
Going out: rewriting the sender
Mac opens example.com. The server's address is 192.0.2.80, and the web page uses Port 443. (Note: an address starting with 192 is not necessarily Private. Only addresses starting with 192.168 are.)
| Where | Sender | Recipient |
|---|---|---|
| At home (before Rue) | 192.168.1.10:50000 |
192.0.2.80:443 |
| On the Internet (after Rue) | 203.0.113.1:40001 |
192.0.2.80:443 |
Rue only rewrites the sender. The recipient stays the same the whole way. 50000 is a Port that Mac's computer picked temporarily, called an Ephemeral Port.
Rue's NAT Table
At the same moment, the TV happens to connect to the same server, and it also uses Port 50000. So Rue picks a different outside Port for it:
| Inside (Private) | Outside (Public) | Remote server |
|---|---|---|
192.168.1.10:50000 |
203.0.113.1:40001 |
192.0.2.80:443 |
192.168.1.11:50000 |
203.0.113.1:40002 |
192.0.2.80:443 |
One Public IP has 65,535 Ports available, so a family can have hundreds of connections open at once without any trouble.
Coming back: look up the table and rewrite the recipient
The server's reply is sent to 203.0.113.1:40001. Rue looks it up in the table, finds that 40001 belongs to Mac, changes the recipient back to 192.168.1.10:50000, and hands it to Mac.
The entries are not permanent. When a connection ends, or has not been used for a while, Rue deletes it.
Packets with no matching entry
A packet arrives for 203.0.113.1:40005. There is no entry for it in the NAT Table, and no Port Forwarding rule either. Rue does not know who to give it to, so it has to drop it.
This makes it harder for people outside to reach devices at home directly, but NAT itself is not designed for security. The real gatekeeper that checks things against rules is the Firewall, which Story 19 covers in detail.
Port Forwarding: delivery instructions written in advance
Mac is at a coffee shop (192.168.0.23) and wants to connect back to the photo server on the desktop computer at home, 192.168.1.12:8080. The coffee shop Router also does NAT, so when the packet leaves, its sender becomes 198.51.100.1.
The packet arrives at 203.0.113.1:8080, but it is not a reply, so there is no entry in the NAT Table. So, back at home, Mac adds a TCP (Transmission Control Protocol) rule on Rue's settings page:
| Protocol | Outside Port | Inside address | Inside Port |
|---|---|---|---|
| TCP | 8080 |
192.168.1.12 |
8080 |
From then on, for every TCP packet sent to 203.0.113.1:8080, Rue changes the recipient to 192.168.1.12:8080 and hands it to the desktop computer. Replies follow the recorded entry back along the same path to the coffee shop.
The price of opening a door
Port Forwarding is like opening a door in the outside wall. Anyone on the Internet can come and knock on 8080. So:
- Only open the Ports you really need, and delete the rule when you no longer use it.
- Use a strong password on the server and keep its software up to date.
- A safer way is to use a VPN (Virtual Private Network): first "go back home" into the home LAN through an encrypted tunnel, then connect to the device. Story 18 explains how.
5. Try It Yourself
Task: Find your home's delivery instructions
- On your phone or computer, check your own IP Address. It usually starts with
192.168., which means it is a Private IP. - Then search for "what is my IP" in a search engine to see the Public IP the Internet sees. The two addresses are different because your Router is doing NAT.
- If a parent or guardian agrees, log in to your home Router's settings page (the address is usually printed on the bottom of the Router) and look for a page called "Port Forwarding" or "Virtual Server". Are there any rules you do not recognise?
- Look, but do not change anything. If in doubt, ask the person who looks after the network at home first.
Mini game
NAT out and back in order
Mac opens example.com. Put the five steps below in the right order.
- example.com's reply is sent to 203.0.113.1:40001
- Mac sends a packet from 192.168.1.10:50000 to 192.0.2.80:443
- Mac receives the reply
- Rue rewrites the sender as 203.0.113.1:40001 and records it in the NAT Table
- Rue looks up the NAT Table and changes the recipient back to 192.168.1.10:50000
6. Where the Analogy Breaks
- The office does more than change addresses. After rewriting the addresses, Rue also has to recalculate the checksums in the IP and TCP Headers. Otherwise the other side would think the packet was damaged.
- The outside Port is not always 40001. The animation uses
40001and40002because they are easy to remember. A real Router picks its own numbers, and sometimes even keeps the original50000, only changing it when two clash. - A building may have more than one office. Some ISPs do not have enough addresses, so they do another round of NAT inside their own network. This is called CGNAT (Carrier-Grade NAT). In that case, your Router's outside address is not a real Public IP either, and Port Forwarding may not work.
- NAT is not security. The office drops letters from unknown senders only because it does not know who to give them to, not because it checks whether the letters are dangerous.
- IPv6 usually does not need a building office. IPv6 has more addresses than we could ever use up, so every device can have its own Public address. NAT is usually not needed, and a Firewall decides who may come in instead.
7. Quiz
8. Key Notes
- Devices at home use Private IPs, and the whole family has only one Public IP. NAT (Network Address Translation) lets everyone share it to go out.
- Going out, Rue changes the sender to
203.0.113.1plus an outside Port and records it in the NAT Table. Coming back, Rue looks up the table and changes the recipient back to the original device. - Rewriting the Port as well is called PAT (Port Address Translation). Different outside Ports tell different devices apart.
- Packets with no entry in the NAT Table are dropped. To connect back home from outside, you need to set up Port Forwarding.
- Port Forwarding opens a door, so only open the Ports you need. NAT is not a Firewall.
Further reading
That is the end of Part 2, "Leaving the LAN". Pip has learned to find the way, swap notes, and go in and out through the building office. Part 3 is about transport and services. A photo is cut into lots of Pips for the journey. What if one of them gets lost? In the next story, TCP shows you how Sequence Numbers and ACKs (acknowledgements) make sure every piece arrives safely.