NAT and Port Forwarding Explained: Public vs Private IP

The short answer

• A private IP works only inside your local network. Many offices in the world use the same addresses, such as 192.168.1.10, and that is fine because they never appear on the internet.
• A public IP is unique on the internet. Your provider gives the office one (sometimes several), and it sits on the router's outside port.
• NAT (Network Address Translation) is how the router lets dozens of devices with private IPs share one public IP: it rewrites outgoing traffic and remembers which reply belongs to which device.
• Port forwarding is a NAT rule that lets traffic from the internet in: "everything that arrives on public port 8443, send to 192.168.1.20".

Private address ranges

Three ranges are reserved for local networks and are not routed on the internet:

If a device's address falls into one of these ranges, it is private by definition.

How NAT works

1. A laptop at 192.168.1.57 opens a website.
2. The router replaces the source address with its public IP and notes the connection in its translation table.
3. The site replies to the public IP.
4. The router looks up the table and passes the reply back to 192.168.1.57.

A useful side effect: nobody from the internet can start a connection to a device inside unless there is a rule for it. NAT is not a firewall, but it hides the internal network by default.

CGNAT: when even the router has no public IP

Many providers do not have enough public IPv4 addresses for every customer, so they apply NAT on their side too. This is CGNAT (Carrier-Grade NAT). Your router gets an address from the provider's internal network — often from the range 100.64.0.0 – 100.127.255.255 — and goes online through a shared public IP.

How to tell:

• check the WAN address in the router's settings;
• compare it with the address shown by any "what is my IP" service.

If they differ, or the WAN address is private or in 100.64.x.x, you are behind CGNAT. Everyday browsing works fine, but port forwarding will not work, because incoming traffic stops at the provider.

When you need a static public IP

A static (dedicated) public IP does not change and belongs only to you. It is worth asking the provider for one when:

• remote employees connect to the office via VPN;
• branches are linked with a site-to-site VPN;
• an external service whitelists your office address (bank systems, partner APIs, cloud admin panels);
• you host something in the office that must be reachable from outside.

A dynamic public IP can change after a reconnect. Dynamic DNS can follow it, but for business connections a static address is simpler and more predictable. Note that a public IP and a static IP are separate things: an address can be public but still change.

Why opening ports is risky

Every forwarded port is a door into your network that the whole internet can knock on. Automated scanners constantly look for open services, and the most common targets are exactly what offices tend to expose:

• RDP (remote desktop) and SSH — password guessing and known vulnerabilities;
• web interfaces of cameras, NAS and recorders — default passwords and outdated firmware;
• databases and accounting systems that were never meant for direct internet access.

Safer alternatives:

• give remote access through a VPN and open only the VPN port, or use a provider of secure remote access;
• if a port must be open, restrict it to known source addresses;
• keep firmware updated, change default passwords, enable two-factor authentication;
• turn off UPnP on the router — it lets devices open ports on their own without you noticing;
• review the list of forwarding rules regularly and delete what is no longer used.