Public IP, Private IP, NAT, and Ports Explained

A home or office can contain many devices with private addresses while presenting one public IPv4 address to the internet. NAT and ports make this work, but they solve different parts of the problem.

Public and Private Addressing

Private IPv4 ranges are used inside networks and are not routed across the public internet. Common examples begin with 10., 172.16 through 172.31, or 192.168. A laptop might be 192.168.1.20 inside a home while the router has a public-facing address supplied by the ISP.

How NAT Tracks Outbound Traffic

For a typical outbound IPv4 connection, the router replaces the private source address and port with its public address and another port. It stores translation state so returning packets can be mapped to the correct internal flow.

A second device can contact the same server through that public address because its translated source port differs. NAT maintains state associating each external flow with an internal endpoint.

What a Port Identifies

An IP address gets traffic to an endpoint. A port lets the operating system deliver transport traffic to the correct listening service. One server can expose HTTPS on TCP 443, SSH on TCP 22, and DNS on UDP or TCP 53.

Diagram 1

How Network Ports Select Services

80 / 443

Conventional HTTP and HTTPS ports.

22

Common SSH administration port.

53

DNS over UDP or TCP.

5432

Common PostgreSQL port; normally kept private.

6379

Common Redis port; normally kept inside a trusted network.

Source and Destination Ports

A browser normally chooses a temporary source port while connecting to a known destination port. A flow might run from 192.168.1.20:53124 to 93.184.216.34:443. Replies reverse those endpoints, letting operating systems and stateful devices associate packets with the correct conversation.

Opening a firewall port does not create a service. A process must be listening, a route must exist, and every policy along the path must allow the traffic. Unexpected inbound traffic behind NAT may also require port forwarding, a tunnel, or a public intermediary.