Many devices, one address: NAT

Many devices, one address

A home has several devices that use the internet.
Phone, laptop, and TV are all connected together.
Each device has its own home address.
It is like splitting room numbers inside the front door.
But the address the outside world sees for your home
is just one, the public address.
When the many devices go outside,
they all go out through that single address.
The thing in the middle that does this is the router.

Tap a home device to send it out. They all go out through the same single public address.

No matter which device you tapped,
the address going out was the same.
Phone, laptop, and TV
all went out wearing the same public address.
From the outside,
all three look like they came from one home.
But here a question appears.
If the address is the same, when a reply comes back,
how does it know whose it was?

It remembers who sent it

The router has a secret notebook.
It is a table.
Which device sent to where outside,
it writes down one line at a time.
Like "TV sent to the video server."
The port slot you learned in lesson 10 is noted too,
so the pairs are told apart even more clearly.
Each outgoing request leaves one line in the table,
so later when a reply comes, it just reads the table.

Tap a device to send it out. The router writes the device-to-request pair into the table, one line at a time.

Each time you sent a device,
a new line piled up in the table.
Now looking at the table,
it is clear which line belonged to which device.
The router writes them all down without forgetting.
This table is the heart of NAT.
The address is bundled into one to go out,
but who sent it is remembered by the table.
Now shall we return a reply?

It returns the reply

An outside server has sent an answer.
That answer first comes to your home's public address.
But inside the home there are several devices.
Who should this answer go to?
The router opens the table it wrote earlier.
"Ah, this answer is the reply to what the TV sent."
Then, just as the table points,
it hands the answer to the TV exactly.
A single table retraces the path.

Look at the reply from outside, open the table, and tap the matching device to return it.

Tap the device the table points to,
and the reply went back exactly right.
Tap a different device,
and it did not match the table, so it did not go back.
The address was bundled into one,
but thanks to the table nothing got confused.
Gather into one on the way out,
and split by the table on the way back,
that is what NAT does every day.

Outsiders cannot get in

Here a nice bonus appears.
For a reply to come back, it needed a pair in the table.
That pair was made when something inside sent first.
So what about a connection started from outside?
There is no such pair in the table.
The router says "I do not know whose answer this is,"
and simply blocks it.
Only what started inside can come back.
So NAT becomes a natural firewall.

Tap a reply that started inside and a connection started from outside. With a pair it passes, without one it is blocked.

The reply that started inside had a pair in the table,
so it came inside safely.
The connection started from outside had no pair,
so it was simply blocked at the door.
Nobody told it to block on purpose.
Because the way it works is returning by the table,
it just turned out that way on its own.
That is why we call this a natural firewall.
The security story is covered more deeply in the next area.

Let's wrap up

Gathered on one line, it's this.
Many devices inside a home
go out through one public address.
The router writes down who sent what
in a table,
and when a reply comes, it reads the table and returns it to the right device.
So many share one address.
And since outsiders cannot get in first,
it even becomes a natural firewall. That is NAT.

Tap the key points in order to review. (out as one address -> remembered by table -> reply returned -> natural firewall)

Now you know how one home, with a single address,
uses the internet together.
And that outsiders cannot just barge in.
But can this natural firewall alone
stop every danger?
A bad connection that started inside
could just pass through, after all.
So a separate guarding device is needed.
In the security area, let's look together, step by step,
at what is guarded and how.