Phones, laptops, a TV and smart devices at home all reach the internet at once, yet your provider usually gives you one public IPv4 address. NAT (network address translation) in your router makes that possible.
How NAT works
Devices at home use private addresses such as 192.168.1.10, which are not routed on the internet. When a device connects to a site, the router replaces the packet’s source address with its own public address and picks a port, records the mapping (“public port 51234 → 192.168.1.10 port 54321”) and sends replies back to the right device. Websites only ever see the router’s address.
Incoming connections and port forwarding
NAT works for connections started from inside. For a connection from outside — to a game server, camera or NAS at home — the router doesn’t know where to send it, so you add a port forwarding rule. Check that it works with the port checker. UPnP lets applications open such rules automatically; convenient, but risky if any device may do it, so switch it off if you don’t need it.
CGNAT: a NAT behind the NAT
Because IPv4 has run out, some providers apply NAT in their own network too: your router itself gets a shared address from 100.64.0.0/10 instead of a public one. That is CGNAT, and port forwarding can’t help because you have no rule on the provider’s NAT.
IPv6 needs no NAT
IPv6 has enough addresses for every device to have its own public one. Protection comes from a firewall that blocks unsolicited incoming traffic, which routers do by default. Check your connection with the IPv6 test.