Networking

Router & NAT

The box most people call "the router" is really several devices sharing one case: a router (this page), a switch, a Wi-Fi access point, and a DHCP server, usually all in one. This page is about the router's own specific job — moving packets between different networks, and translating addresses at the boundary between them.

Quick reference

What it is: A device that forwards packets between two or more distinct networks, based on IP address.
Mental model: A mail sorting office: it reads the destination address on each package and decides which outgoing truck (network) it belongs on — a switch never makes this decision, it only knows about the one building it's in.
Key numbers: Operates at the Network layer; a home router typically bridges a private LAN (192.168.x.x) to one public IP from the ISP.
Reach for it when: Never chosen directly by an application — it's the infrastructure that makes a LAN's devices reachable from, and able to reach, the wider internet.

Routing vs. switching

This is the same distinction Ethernet and IP already draw at the protocol level, now attached to actual hardware:

A switch: Connects devices on the same network, forwarding by MAC address — it has no concept of "a different network" at all.
A router: Connects different networks, forwarding by IP address — it's the device that exists specifically because a switch's job stops at the edge of one local network.

A home "router" box does both: it switches traffic between your LAN's wired/Wi-Fi devices, and separately routes traffic between your LAN as a whole and your ISP's network — two different jobs, bundled into one device for convenience.

The default gateway

Every device on a LAN is configured — almost always automatically, via DHCP — with a default gateway address: the router's own LAN-facing IP. The rule a device follows is simple: if a destination address is on my own local network, send the frame directly; if it isn't, hand it to the default gateway and let it figure out the rest. This is the exact mechanism IP's own addressing section describes as "a packet is handed to a gateway/router."

NAT — sharing one public address

Private IP ranges like 192.168.x.x aren't routable on the public internet — so every device behind a home router needs to be translated to the router's one public IP before its traffic can leave the building. Network Address Translation (NAT) is what performs that translation, and it does it per-connection, not just per-device, by also rewriting the port number.

This is why devices behind the same home router look identical from the internet's point of view — only the translated (IP, port) pair, tracked in the router's own table, tells them apart.

Port forwarding

NAT's default behavior blocks unsolicited inbound connections — nothing in its table yet means nothing to translate an incoming packet against, so it's dropped. Port forwarding is the deliberate exception: a manually configured rule saying "anything arriving on public port X should always go to this specific internal device," used whenever something inside the LAN — a home server, a self-hosted service, an embedded device being remotely debugged — needs to accept connections initiated from outside.

Real-world applications

Every home and office internet connection — the router is the single boundary between a private LAN and the public internet.
Cloud VPC routing — cloud providers implement the same routing/NAT concepts in software, at massive scale, to connect virtual private networks to the public internet.
IoT device remote access — a self-hosted home-automation hub reachable from outside the house is almost always relying on either port forwarding or, more commonly today, an outbound tunnel like the reverse SSH tunnels covered on the SSH page — specifically to avoid needing port forwarding at all.

Gotchas

Field notes

Double NAT — two routers chained together (an ISP-provided modem/router combo plus your own router behind it) means a device is now two translation hops from the public internet — port forwarding on the inner router alone often silently fails, since the outer router never forwards the traffic to it in the first place.
NAT is not a firewall, even though it accidentally blocks unsolicited inbound traffic by default — a real security boundary needs its own dedicated rules, not this side effect.
Some older protocols embed an IP address or port directly inside their own payload (not just the packet headers) — NAT has no way to rewrite that, which is exactly the class of problem behind FTP's active-mode NAT breakage.