What NAT does on your router (and why every home network needs it)

Short answer: NAT (network address translation) is the function your router runs that lets every device on your network share one public IP address. It rewrites the local address on outgoing traffic to the router’s public one, keeps a table of which device asked for what, and uses that table to route the replies back to the right device.

Where NAT sits on your network

Your ISP hands your router one public IP address. Everything behind that router — your laptop, your phone, the smart speaker, the printer — gets a private address instead, usually something like 192.168.1.*. Private addresses aren’t unique on the internet; your neighbor’s router hands out the same range to their own devices. They only have to be unique inside your network, which is covered in more detail in MAC address vs IP address.

When your laptop requests a page, NAT swaps the laptop’s private address for the router’s public one before the request leaves your network, and notes the swap in a table. When the reply comes back addressed to the router’s public IP, NAT checks that table and forwards it to the laptop specifically, not to every device on the network.

Why it exists

NAT wasn’t built as a security tool. It exists because IPv4 only has about 4.3 billion possible addresses, nowhere near enough for every device on every home network to have its own. NAT lets one public address cover an entire household, which is why your router needs it even if you only have a handful of devices.

The firewall side effect

Because NAT only knows how to route a reply to a request your network already made, traffic that arrives unsolicited has nowhere to go. The router has no entry in its table for it, so it drops it. That’s the behavior people are describing when they say NAT “acts like a firewall” — it’s a consequence of how translation works, not a rule someone configured on purpose.

This default block is also exactly what port forwarding exists to override. A forwarding rule tells the router “traffic on this port always goes to this specific device,” which punches a deliberate hole in the behavior NAT would otherwise apply automatically. A DMZ setting goes further and sends all unmatched inbound traffic to one device, skipping NAT’s default drop entirely for that device.

Where NAT shows up in your router’s settings

A few places you’ll run into NAT by name or by effect:

• Port forwarding and virtual server rules — these are explicit exceptions to NAT’s default block, routing one port to one local address.
• DMZ — removes the block for one device across all ports, which is why it’s treated as a last resort rather than a normal setting.
• UPnP — lets an app or device ask the router to open a path for itself automatically, instead of you configuring a rule by hand.
• “NAT type” in game and console settings — Open, Moderate, or Strict describes how easily that device can be reached by other players, which depends on how your router’s NAT and any forwarding rules are set up.

When NAT gets in the way

Most everyday use never notices NAT, because the device inside your network starts the connection and the router already knows where the reply goes. It becomes visible when something outside needs to reach in first: hosting a server, running a home security camera’s remote feed, or letting a friend connect directly to a device on your network. In those cases, you’re working around NAT’s default behavior on purpose, usually with a forwarding rule or, less often, a DMZ entry.

If you’re trying to track down what’s actually on your network before changing anything at the router level, start with how to see who is connected to your WiFi or run a lookup through the MAC vendor tool to identify an unfamiliar device by its manufacturer.