How does NAT work

Many devices, one address

A home has more than one device that uses the internet. The phone, the laptop, and the TV all connect to the router, and the router hands each of them an address that works only inside the home. This is called a private address, a bit like flat numbers that only make sense inside one apartment building.
The internet outside, however, sees just one address for your home: the router's public address. So when the devices go out, the router removes the private address and puts its public address in its place. This is NAT, short for network address translation.

Tap a home device to send it out. All three leave through the same single public address.

Whichever device you tapped, the address going out was the same. The phone, the laptop, and the TV all left wearing the same public address, so from outside, all three requests come from one home.
There is a reason for sharing an address like this. The address system most of the internet still uses has fewer addresses than there are people in the world, so there are not enough public addresses to give every device in every home its own. But a shared address raises a question: when a reply comes back, how does the router know which device it belongs to?

Writing down who sent it

The router keeps a record of every request that goes out. That record is the NAT table: one line for each request, noting which device sent it to which server outside, something like "TV sent to the video server."
The port number from earlier goes in too. Even if two devices send requests to the same server at the same moment, each line has its own port number, so the pairs never get mixed up. Since every outgoing request leaves a line in the table, the router only has to look it up when a reply arrives.

Tap a device to send it out. The router writes the device ↔ outside request pair into the table, one line at a time.

Each time you sent a device out, a new line was added to the table. Now the table alone shows clearly which line belongs to which device.
This table is the heart of NAT. The address is bundled into one on the way out, but the table remembers who sent what. Its lines do not stay forever: if nothing passes for a while, the router deletes them. Next, let's see how the table is used when a reply comes back from outside.

Returning the reply

A server outside has sent an answer. The answer arrives first at your home's public address, that is, at the router. There are several devices inside, so who should receive it?
The router looks up the table it wrote earlier. Matching the port number and the sending server against the lines in the table shows that this is "the reply to the TV's request to the video server." The router then removes the public address, puts the TV's private address back, and hands the answer to the TV. One table retraces the way home.

Look at the reply from outside, find its pair in the table, and tap the matching device to return it.

When you tapped the device the table pointed to, the reply found its way home. Tapping a different device did not match the table, so the reply did not go there.
The address was bundled into one, yet thanks to the table nothing gets confused. On the way out, many addresses are gathered into one; on the way back, the table splits them apart again. While you watch videos and send messages at home, the router repeats this without a break.

Outsiders cannot come in first

There is a bonus here. For a reply to come in, it needed a pair in the table, and that pair was created when a device inside sent a request first.
So what about a connection started from outside? There is no such pair in the table. The router does not know whom to hand it to, so it simply drops it. Only connections that started inside can come back in. That is why NAT works as a natural firewall.

Tap the reply to a request started inside and the connection started from outside. With a pair in the table it passes; without one it is blocked.

The reply to a request started inside had a pair in the table, so it came in safely. The connection started from outside had no pair, so it was stopped at the door.
Nobody set a rule to block it. It happens on its own because replies are returned by the table, which is why it is called a "natural" firewall. Still, NAT was never designed for security, so it cannot protect a home by itself. What needs protecting, and how, is covered separately in the security area.

Summary

In short: each device in a home has its own private address, but on the way out it passes through the router and leaves under one public address.
The router writes down who sent what to where, together with a port number, and when a reply comes, it reads the table and returns the reply to the right device. That is how many devices share one address without confusion. And since outsiders cannot come in first, it even works as a natural firewall. That is NAT.

Tap the key points in order to review. (out as one address → remembered by the table → reply returned → natural firewall)

Now you know how one home uses the internet together through a single address. The road between the devices inside and the world outside is in place.
So what actually travels along that road? The thing we do most often is open web pages in a browser. The next lesson covers the agreement a browser and a web server use to exchange web pages: HTTP.