NAT and port forwarding, without the jargon

Your internet provider gives your home one public address. Every phone, laptop and television behind the router shares it. The trick that makes this work is NAT, network address translation, and it explains both why ordinary browsing just works and why hosting anything at home does not.

What the router is doing

When a device inside asks for a web page, the router swaps the device’s private address for the public one, sends the request, and notes in a table which device asked. When the reply comes back, the table says where it goes.

Traffic that starts outside has no entry in that table. A connection arriving at your public address on some port reaches the router, which has no idea which of your devices it is for, and drops it. That is why a game server, a NAS or a camera at home cannot be reached from outside by default — and also why NAT quietly protects devices you never meant to expose.

Port forwarding

Port forwarding is a permanent entry in that table: “anything arriving on port 25565 goes to 192.168.1.40”. To set one up safely:

1. Give the device a fixed local address. Most routers call this a DHCP reservation. Otherwise the device’s address changes one day and the rule points at something else.
2. Forward only the port the service needs, to that one device.
3. Never forward management ports. Remote desktop (3389), file sharing (445), databases and the router’s own admin page are the first things attackers scan for. The common ports reference marks them.
4. Keep the device updated and use strong passwords: once a port is forwarded, anyone on the internet can knock.

For reaching your own devices remotely — files, a home server, a camera — a VPN into your home network is safer than forwarding ports: one encrypted door that only you have a key to, instead of a separate open door per service.

When port forwarding cannot work: CGNAT

Some providers, especially mobile and some fibre providers, share one public address between many customers. This is carrier-grade NAT, and your router is behind a second NAT you do not control. Port forwarding on your router then achieves nothing, because traffic never reaches it.

To check: compare the address your router shows as its internet or WAN address with the address at the top of the home page. If they differ, or the router’s address is in 100.64.0.0/10 or a private range, you are behind CGNAT. The fixes are asking the provider for a public address (sometimes a paid option), using IPv6, or using a tunnel service.

UPnP

Universal Plug and Play lets devices open ports on the router by themselves. Game consoles like it because it makes multiplayer work without setup. The catch is that anything on your network can do it — including malware. If nothing you use needs it, switch it off; if something does, check the router’s list of UPnP mappings now and then.

IPv6 is different

With IPv6 every device has its own public address and there is no translation. What decides whether a connection gets in is the router’s firewall, which by default blocks incoming connections just as NAT did. The IPv6 equivalent of port forwarding is a firewall rule allowing one port to one device.

Checking your setup

What your IP reveals explains what your public address does and does not expose. To confirm a forwarded port works, test from outside your network — a phone on mobile data, or a friend — and only ever test connections you own.