NAT
Network Address TranslationNAT is the reason your whole house shares one address. At the edge of a network it rewrites the source address and port of every outgoing packet, remembers the mapping it made, and reverses it on the way back — an ingenious workaround for IPv4 running out of addresses.
NAT rewrites addresses at the border so many private hosts share one public IP — and the mapping table is what makes replies find their way home.
How it works
Two hosts may pick the same source port, so NAT gives each flow its own public port. A reply to 40002 can therefore only belong to one conversation — and an unsolicited packet matches nothing and is dropped.
What NAT does, step by step
A host sends out a packet with a private source address that is not routable on the internet.
The gateway swaps in its public address and a free port, and stores the pair in its table.
The return packet is addressed to that public port; the gateway looks the port up in the table.
It writes the original private address and port back in and forwards the packet to the right host.
In cybersecurity
NAT hides internal hosts as a side effect — genuinely useful — but it is an addressing trick, not a security policy.
It drops unsolicited inbound because nothing matches, not because a rule said to. Add real filtering.
Every forwarded port is a deliberate route straight to an internal host — audit them.
Software on the LAN can ask the router to forward ports with no one approving it.
The translation table is finite; a flood of flows fills it and new connections fail.
Behind CGNAT thousands share one address, so logs need the port and the timestamp too.
Protocols that carry addresses inside the payload — SIP, FTP — need helpers or they fail.