Private Addresses and NAT

Private addresses are three IPv4 ranges set aside for use inside homes, offices and cloud networks, which routers on the internet refuse to carry. NAT (network address translation) is what lets a machine with a private address reach the internet anyway: the router at the edge rewrites the packet's source address to its own public address, and rewrites the replies back again.

Picture a household with a laptop, two phones and a television, all on 192.168.1.x addresses. Next door, another household uses exactly the same addresses. Both reach the same websites at the same time, and nothing clashes, because the internet never sees any of those addresses: it sees one public address for each house.

IPv4 has about 4.3 billion addresses, fewer than the devices that want one. Private ranges let every network reuse the same addresses internally, so each home or office needs only one or a few public ones.

NAT rewrites the source address and, usually, the source port, and keeps a table of each mapping. When the server's reply arrives for 198.51.100.7 port 40001, the router looks it up and rewrites the destination back to 192.168.1.20 port 51514. The port change is what lets hundreds of devices share one public address at once. The values above are illustrative.

The table only gains entries from the inside out, which has a consequence: nothing on the internet can start a connection to a device behind NAT, because the router has no entry saying where to send it. That is often welcome, but it is not a security feature, and it is the main obstacle for video calls and games that want devices to connect directly.

172.32.0.1 is not private: the second range ends at 172.31.255.255. A fourth range, 100.64.0.0/10, is used by internet providers for a second layer of NAT and is not for ordinary networks.

So when a server logs a request from an address you do not recognise, or a device behind a home router cannot be reached from outside, NAT is the first thing to account for.