If you look in a corner of your apartment or small office, you will almost certainly spot a small plastic box with blinking LEDs and several antennas. We commonly call this box a "Wi-Fi router" or "cable modem". But in computer networking, this device is known as a Small Office / Home Office (SOHO) Gateway. Rather than being a single piece of hardware, it is actually an ingenious three-in-one appliance combining an Ethernet switch, a Layer 3 router, and an automated DHCP server inside a single enclosure.
More importantly, this small gateway performs a vital translation service that keeps the modern Internet functioning despite an acute global shortage of IPv4 addresses: Network Address Translation (NAT).
Private vs. Public IPv4 Addresses
When the Internet Protocol was designed in the late 1970s, its creators allocated approximately 4.3 billion total 32-bit addresses. At the time, with only a few dozen research universities connected, 4.3 billion seemed infinite. But by the late 1990s, with computers multiplying in every home and school, the world began running out of numbers.
To prevent the Internet from grinding to a halt, the Internet Engineering Task Force (IETF) issued RFC 1918, reserving three specific ranges of addresses for private use:
| RFC 1918 Private Range | Prefix Length | Total Addresses | Typical Real-World Use Case |
|---|---|---|---|
10.0.0.0 – 10.255.255.255 |
/8 |
16,777,216 | Large enterprise campuses, datacenters, banks |
172.16.0.0 – 172.31.255.255 |
/12 |
1,048,576 | Medium corporate networks, university departments |
192.168.0.0 – 192.168.255.255 |
/16 |
65,536 | Home routers, small coffee shops, local office LANs |
Private IP addresses are strictly forbidden on the public Internet backbone. If a packet with source IP 192.168.88.10 leaked out onto an international Tier-1 ISP carrier, upstream transit routers would immediately drop it. Thousands of homes share the exact same 192.168.88.10 address—an ISP would have no idea which physical subscriber to reply to!
How NAT Masquerade Works
Your Internet Service Provider (ISP) leases you only one single public IP address (such as 198.51.100.2). Yet your household might have four laptops, three phones, two smart TVs, and a gaming console all streaming video simultaneously. How do ten devices share one single public address?
Through NAT Masquerade (Port Address Translation / PAT):
- Outbound Packet Interception: Workstation PC-1 (
192.168.88.10) sends a web packet to an external server (198.51.100.1) using source TCP port 50231. - Address Rewriting: As the packet crosses from the Home Router LAN to its WAN port, the router intercepts the packet. It replaces the private source IP (
192.168.88.10) with its own public IP (198.51.100.2) and records this mapping in an internal NAT Translation Table: "Port 50231 belongs to PC-1". - Inbound Reply Demultiplexing: When the external server replies, it addresses the packet to the router's public IP (
198.51.100.2:50231). The router checks its NAT table, identifies that port 50231 was opened by PC-1, rewrites the destination back to192.168.88.10, and delivers it across the local switch.
To the outside world, your entire home or office looks like a single computer speaking from a single public IP. NAT simultaneously conserves global IP space and acts as a basic hardware firewall, because unsolicited incoming connections from the Internet cannot reach your internal PCs unless an internal device initiated the connection first.
The Port Forwarding Dilemma (Hosting at Home)
While NAT masquerade protects your computers from unexpected inbound scans, it creates a puzzle when you want someone from the outside to connect to you. For example, if you run a multiplayer game server or host a home security camera, an outside friend typing your public IP address will hit your router's WAN port. The router looks at its NAT table, finds no existing session, and drops the packet.
To solve this, engineers configure Port Forwarding (Destination NAT). You tell your router: "Whenever someone connects to public Port 25565, forward those packets directly to my gaming desktop at 192.168.88.10." The router creates a permanent doorway through its NAT firewall.
The Bridge to Domain Names
Now our laptops can leave the building, share one public ISP address, and reach servers on the global internet. But nobody browses the web by typing raw public addresses like 198.51.100.1 into their phones. Memorizing numbers for dozens of websites is impossible for humans.
Whenever you type a web link into your browser, your computer first sends a background query through your NAT router asking for the server's real IP. In our next chapter, we will see how the Domain Name System (DNS) turns friendly names like portal.corp into IP addresses in milliseconds.