The math that broke: only 2^32 addresses
From the previous guide you already know that an IPv4 address is 32 bits, written as four numbers like 192.168.1.10, and that CIDR lets us slice the address space into prefixes of any size. Now do the arithmetic that has worried network engineers since the 1990s. Thirty-two bits gives 2^32 distinct addresses, which is about 4.3 billion. That sounds enormous, until you remember the planet has more than 8 billion people, and many of us carry a phone, a laptop, a watch, and a house full of gadgets that all want to be online.
It is actually worse than 4.3 billion suggests. Big chunks of the space were never usable: blocks reserved for experiments, for multicast, for loopback (the 127.x.x.x range your computer uses to talk to itself), and large early allocations handed out generously when 4.3 billion still felt infinite. The usable public pool is meaningfully smaller. The central registries that hand out addresses formally exhausted their free pools around 2011 to 2019, depending on the region. The Internet did not stop growing in 2011, so something had to give.
Private addresses: the area code you can reuse
The first half of the trick is to set aside some address ranges and declare them private: free for anyone to use inside their own network, but never routed across the public Internet. Three ranges were reserved for this: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The 192.168.x.x one is the address your home router almost certainly handed your laptop. A private IP address is like an internal extension number in a big office: dial 'extension 42' from inside the building and it works perfectly, but it is meaningless to someone phoning from another company, where extension 42 is a completely different desk.
Because private ranges never leave their own network, every household and office can reuse the very same numbers without conflict. Millions of homes simultaneously have a device at 192.168.1.10, and none of them collide, because that address never travels out onto the public Internet. This reuse is the whole point: a single public address can stand in front of an entire private network of thousands of devices. Your router typically hands these private addresses out automatically using DHCP, the protocol from earlier that leases an address to each device as it joins.
NAT: one public address, many private ones
Private addresses solve reuse, but they raise a problem: if your laptop's address is meaningless outside your house, how does a reply from a web server ever find its way back to you? This is the job of NAT, Network Address Translation. Your home router sits on the border with one foot in each world: a private address like 192.168.1.1 facing inward to your devices, and a single public address (the one your provider gave you) facing the Internet. NAT is the receptionist at that border who rewrites the address on every packet as it crosses.
The deep trick is that NAT does not just swap addresses; it also juggles port numbers. Recall from the transport layer that every connection is identified not by an address alone but by the pair of address and port. NAT exploits this. When your laptop opens a connection out to a web server, the router rewrites the packet's source from your private address and port to its own public address and a freshly chosen port, and it writes that swap down in a translation table. This flavour, where many devices share one public address by giving each conversation its own port, is so common it has its own name: PAT, or NAPT, sometimes just called 'NAT overload'.
- Your laptop (private 192.168.1.10, source port 51000) sends a packet to a web server at 203.0.113.5 on TCP port 443. It addresses the packet to the server but the source is its own private pair.
- The packet reaches your router. NAT rewrites the source to (public 198.51.100.7, port 61234), picks that port to be unique, and records the mapping 198.51.100.7:61234 -> 192.168.1.10:51000 in its table. It then sends the packet out to the Internet.
- The server replies to 198.51.100.7:61234, because that is the only source it ever saw. It has no idea your private laptop exists.
- The reply arrives at your router. NAT looks up 61234 in its table, finds 192.168.1.10:51000, rewrites the destination back to your private pair, and forwards it onto your home network. Your laptop receives the reply as if nothing happened.
NAT translation table (one home router, one public IP) Public side (what the Internet sees) Private side (your devices) ------------------------------------ --------------------------- 198.51.100.7 : 61234 <--> 192.168.1.10 : 51000 (laptop) 198.51.100.7 : 61235 <--> 192.168.1.22 : 49870 (phone) 198.51.100.7 : 61236 <--> 192.168.1.10 : 51200 (laptop, 2nd tab) One public address out front; the port column keeps every conversation separate so replies find the right device.
What NAT quietly breaks
NAT is brilliant, but it is not free. The deepest cost is that it breaks the Internet's original promise that any device can talk directly to any other. Behind NAT, your laptop has no public address, so nobody on the outside can start a connection to it. Outbound works because the router learned the mapping when you sent the first packet; but an unsolicited inbound packet arrives with no table entry, and the router has no idea which private device it belongs to, so it drops it. This is why running a game server or video call from behind NAT needs extra machinery like port forwarding or 'hole punching' to pry a path open.
There is also a tempting misconception worth killing now: people often say NAT is a security feature. It is not, or at least it was never designed to be one. It is true that as a side effect, devices behind NAT are not directly reachable from outside, which blocks some casual probing. But hiding addresses is not the same as inspecting and filtering traffic. Real protection is the job of a firewall, a separate mechanism that deliberately decides which traffic to allow. NAT was an address-exhaustion stopgap that happens to obscure your devices, and treating that side effect as your security plan is a mistake.
NAT also adds work and breaks assumptions. The router must keep state for every active conversation, so it can run out of table space, and an entry that goes idle gets timed out and forgotten, which is why long-quiet connections sometimes mysteriously die. Protocols that carry an IP address inside their own data, rather than only in the packet header, get confused when the header is rewritten but the embedded address is not, and need special helper code to limp along. None of this is fatal, but it is the accumulated friction of a layering violation: a box in the middle is rewriting addresses that were meant to be end-to-end.
A stopgap that overstayed its welcome
Step back and the shape of the whole hack is clear. Private addressing lets the same numbers be reused everywhere; NAT lets a whole private network hide behind one public address by tracking conversations with port numbers. Together they stretched the 4.3 billion IPv4 addresses to cover billions more devices than the math should allow. It is genuinely one of the most consequential pieces of engineering duct tape ever applied, and your home network depends on it right now.
But it is still duct tape. NAT trades away the clean, direct, any-to-any model the Internet was built on, in exchange for buying time. The real cure was always to make addresses bigger, which is exactly what IPv6 does, and the irony of the next guide is that NAT worked so well it dulled the urgency to switch. Understanding NAT is therefore understanding both why the Internet kept running past its address limit, and why the long, slow migration to a genuinely bigger Internet has been such a hard road.