What NAT is, explained like you're human

Think about an apartment building. One street address, a couple hundred apartments, and a mailroom in the lobby. Nobody outside knows which apartment is which. They just know the building.

Your router is that mailroom. And it's a very particular mailroom.

One address, a whole house

Every device on the internet needs an address to be reached at. The old kind (IPv4, the dotted numbers like 203.0.113.7) only has about 4.3 billion of them, which sounded like plenty in 1981 and ran out a long time ago.

So your ISP gives your whole house one public address, and your router hands out private ones inside: usually 192.168.x.x, sometimes 10.x.x.x. Those private addresses are reused in millions of houses at once. They only mean something inside your four walls.

The mailroom

When your laptop asks a website for something, the request goes to the router. The router swaps your laptop's private address for the house's public one, sends it out, and writes in its logbook: "laptop, asked that website, this exact conversation".

The reply comes back addressed to the building. The router checks the logbook, finds the matching line, and walks it up to the laptop. Your phone, your TV and your game console are all doing the same thing at the same time, and the logbook keeps them straight.

So what happens when your friend knocks?

Your friend's game sends a connection to your public address. It arrives at the router, and the router goes to the logbook. Nothing. Nobody in the house started this conversation.

It doesn't know if it's for the laptop, the phone, the server or the fridge, so it does the only safe thing. It drops it. No error, no message back. From your friend's side, your server just doesn't exist.

And here's the part that's easy to miss: this is working as designed. NAT is the reason random people on the internet can't poke at your printer. It's great for your smart fridge. It's terrible for your Valheim world.

Ports, quickly

An address gets you to a machine. A port gets you to a program on it, kind of like an apartment number. A Minecraft server listens on port 25565, Palworld on 8211. The router's logbook tracks address and port together, which is how it tells two games on the same PC apart.

That's also why the classic fix is called a port forward: you leave the mailroom a standing instruction for one port, so it knows where to send knocks that nobody asked for.

Doesn't IPv6 fix all this?

In theory, mostly. IPv6 has enough addresses for every device to have its own, so there's no need to share. In practice your router still blocks unsolicited incoming traffic, lots of ISPs and games are still IPv4-first, and you need every one of your players to have working IPv6 too. It'll get there. It isn't something you can count on for a game night yet.

Next up, the fix most people reach for first: port forwarding, and why it keeps not working.