Every device connected to an IP network needs an address. But the address you see in your computer's settings is almost never the one websites see. Between the two sits NAT, a mechanism created to save IPv4 addresses that today shapes many practical choices: from remote video surveillance to a home server, all the way to online gaming.
What an IPv4 address looks like
An IPv4 address is a 32-bit number, written as four numbers from 0 to 255 separated by dots, for example 203.0.113.45. There are about 4.3 billion combinations in total, far fewer than the devices connected today. That is why public IPv4 addresses are a scarce and valuable resource.
Each address comes with a subnet mask (or prefix), which indicates which part identifies the network and which the individual host. With a /24 prefix, also written 255.255.255.0, the first three numbers identify the network and the last one the device: 192.168.1.0/24 covers addresses 192.168.1.1 to 192.168.1.254 usable by devices.
Private addresses: reserved for internal networks
RFC 1918 reserves three address blocks for use in private networks. They are never routed on the Internet, so anyone can reuse them inside their own network:
| Block | Range | Typical use |
|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | Large corporate networks |
| 172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | Corporate networks, containers |
| 192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | Home and small office networks |
There are other special ranges worth recognising: 127.0.0.0/8 is loopback (the device itself), and 169.254.0.0/16 is the address a computer assigns itself when it gets no reply from the DHCP server. If you see a 169.254.x.x address, the device has not obtained a valid configuration.
Public address: how the Internet sees you
The public address is the one your provider assigns to your line, and it is unique on the Internet. It is the address that appears in the logs of the sites you visit. It can be:
- dynamic, meaning it may change at every reconnection or after a certain time;
- static, assigned permanently, often for a fee or included in business plans.
To find it, simply use one of the many "what is my IP" services, or the router's status page, which usually shows it as the WAN address.
How NAT works
The home router acts as an intermediary between internal devices and the Internet. When your PC with address 192.168.1.20 opens a connection to a website, the router:
- replaces the source address with its own public address;
- assigns the connection a source port and records it in a table;
- when the reply arrives, looks up the table and forwards it to the right PC.
This variant, which uses ports to tell connections apart, is technically called NAPT or PAT, but in everyday language it is simply called NAT. It lets dozens of devices share a single public address.
An important side effect: unsolicited inbound connections are dropped, because the router does not know which device to deliver them to. To expose an internal service you need to configure port forwarding, telling the router that, for instance, traffic arriving on port 443 should be forwarded to the server at 192.168.1.50.
CGNAT: when NAT happens twice
Many providers, especially on mobile networks, fixed wireless and some fibre plans, no longer give every customer a public address. Instead they apply Carrier-Grade NAT: several customers share the same public address, and the home router receives a non-public address on its WAN, often in the 100.64.0.0/10 range, reserved precisely for this purpose.
How to recognise it:
- the WAN address shown by the router is private or belongs to 100.64.0.0/10;
- it does not match the one external websites see.
With CGNAT, port forwarding on your router is not enough, because there is a second NAT you do not control. The practical solutions are to ask the provider for a public address (some grant it free, others charge), to use IPv6 if available, or to rely on a tunnel or VPN with a public exit point.
Practical tips
- For your home network, pick an uncommon subnet such as 192.168.37.0/24: you will avoid conflicts when connecting by VPN to networks that use the classic 192.168.1.0/24.
- Reserve addresses in DHCP for devices that must stay fixed, such as printers and NAS units, instead of configuring them manually on each device.
- Open ports to the outside only when strictly necessary, and prefer a VPN for remote access.
- If an exposed service stops working after a change of plan, check straight away whether you have ended up behind CGNAT.
In short
- Private addresses (10/8, 172.16/12, 192.168/16) are valid only inside local networks.
- The public address identifies your line on the Internet and can be static or dynamic.
- NAT lets many devices share one address but blocks unconfigured inbound connections.
- With CGNAT the provider adds a second NAT, and home port forwarding is no longer enough.
