NAT & firewalls
Your home has lots of gadgets — a laptop, a phone, a TV, maybe a game console — but to the rest of the internet they all look like ONE address. How? And how does your router keep strangers from poking at your devices? Two ideas do this work: NAT, which lets many devices share a single public address, and a firewall, which decides which messages get in and out. Both live in the little box your internet comes through (your router).
NAT — many devices, one public address
Each device in your home has its own PRIVATE address — a name that only makes sense inside your house, like '192.168.0.5'. Those private addresses are great at home but useless on the wider internet; millions of homes reuse the exact same private numbers, so they can't be unique mailing addresses. So your router does a clever trick called NAT (Network Address Translation). Think of your home as an apartment building with ONE street address and a front-desk clerk. When your phone sends a request out to the internet, the clerk swaps the phone's private address for the building's single public address, and writes a note: 'this request came from the phone.' To the internet, the request looks like it came from the building, not any specific apartment. When the reply comes back to that one public address, the clerk checks the note — 'ah, this is for the phone' — and hands it to the right device. That memory of who-asked-for-what is the whole trick: one public address out front, the clerk routing each answer to the correct device inside.
Why we need NAT at all
There simply aren't enough of the older public addresses (called IPv4) to give every gadget on Earth its own. NAT lets a whole household — or a whole office — sit behind a single public address, which stretches the limited supply a very long way. It also has a happy side effect: because the outside world only sees the front desk, it can't directly address the gadgets hiding behind it. A stranger on the internet has no private address to aim at. That's not a full security wall by itself, but it does mean your devices aren't sitting out in the open with their own public doorways.
Firewall — a guard with a guest list
A firewall is a guard standing at the door deciding which messages may pass. It works off RULES — a guest list. 'Replies to requests my own devices made? Come in. A web page my laptop asked for? Allowed. Some random machine on the internet trying to knock on my devices uninvited? Blocked.' Picture a bouncer at a club checking names against a list. Messages that match an allowed rule get waved through; everything else is turned away at the door. The rules can guard traffic going OUT too — a workplace might block certain sites — but the most important job for a home is keeping unwanted traffic from coming IN. NAT and the firewall usually live together in the same router and team up: NAT hides your devices behind one address, and the firewall enforces the guest list on top. Together they're why a stranger across the world can't just reach into your home network and start talking to your TV.
It's a tradeoff
| Option | 👍 Pro | 👎 Con |
|---|---|---|
| NAT (share one public address) | Many devices use one address; stretches the limited supply; outsiders can't directly address your gadgets. | The router must remember every conversation; some apps (like peer-to-peer or hosting a server at home) get tricky because there's no direct doorway in. |
| Firewall (rules-based guard) | Blocks unwanted messages by rule; precise control over what's allowed in and out. | Rules that are too strict can block things you DID want; too loose and unwanted traffic slips through. Someone has to keep the guest list right. |
Questions you might have
▸If all my devices show the same public address, how does a reply find the right one?
The router keeps a little note for every request that goes out — 'this one came from the phone, this one from the laptop.' When a reply arrives at the single public address, the router checks its notes and delivers it to the device that originally asked. The outside world never needs to know which device it was; the router remembers for everyone.
▸Is a firewall the same thing as NAT?
No, they're two different jobs that often live in the same box. NAT is about ADDRESSES — letting many devices share one public address and routing replies back. A firewall is about PERMISSION — checking each message against rules and blocking the ones not on the guest list. NAT happens to hide your devices a bit, but the firewall is what actually decides yes-or-no on traffic.
▸Does the firewall block things my own apps need?
It can if the rules are too strict, but normally it's set up to allow replies to anything your devices asked for. The pattern is: your laptop asks for a page (going out is fine), so the reply coming back matches a request and is let in. What gets blocked is traffic that knocks uninvited — a stranger starting a conversation your devices never asked for.
▸If NAT hides my devices, why do I still need a firewall?
NAT mostly hides devices as a side effect — it's really there to share one address, not to guard the door. A firewall is the deliberate guard with explicit rules, and it can make finer decisions (block this site, allow that app) that NAT can't. They're strongest together: NAT keeps your devices off the open street, the firewall enforces the guest list.
Best read after: IP addresses