Cyber Basics • Lesson 05

Understanding Routers & NAT

Discover how devices communicate between networks, why your home uses private IP addresses and how NAT connects them to the internet.

The basics

What does a router actually do?

A router connects different IP networks and forwards packets towards their destinations. Your home router usually connects your local network to your internet provider.

Think of it this way:
An IP address identifies a destination. A router helps traffic find a route towards that destination.

Default gateway

Getting outside your network.

When your computer needs to communicate with a destination outside its local network, it normally sends the packet to its default gateway. That gateway is usually your router.

Your computer
192.168.1.25

→

Default gateway
192.168.1.1

→

Internet

Your computer uses its routing table and network configuration to decide whether traffic should stay local or use a gateway.

Private and public IPs

Why doesn't every device need a public IPv4 address?

Most home networks use private IPv4 addresses. These addresses can be reused across different private networks and aren't routed directly across the public internet.

Common private IPv4 ranges

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

Network Address Translation

How does NAT work?

Network Address Translation changes IP addressing information as packets pass through a router or firewall.

A common home setup uses Port Address Translation (PAT), allowing multiple private devices to share one public IPv4 address. The router tracks connections and translates addresses and ports so returning traffic reaches the correct device.

Laptop
192.168.1.25

→

Router performing NAT
203.0.113.10

→

Web server
198.51.100.20:443

Important: NAT and firewalls aren't the same thing. NAT translates addressing information. Firewall rules determine which traffic is permitted or blocked.

Port forwarding

What about incoming connections?

Port forwarding creates a translation that directs traffic arriving at a particular external address and port to an internal device and port.

203.0.113.10:443 → 192.168.1.50:443

This can make an internal service reachable from outside your network, provided firewall rules and upstream connectivity allow it.

Only expose services when necessary. Restrict access, keep software updated and use secure authentication.

Security

What does a SOC analyst see?

Firewall and NAT logs can help analysts understand connections between internal devices and external systems.

SRC=192.168.1.25
DST=198.51.100.20
PROTO=TCP
SPT=52144
DPT=443
ACTION=ALLOW

The source identifies the internal device before translation. Depending on where logging occurs, an external observer may instead see the router's translated public address and port.

Try it yourself

Find your default gateway.

On Linux:

ip route

On Windows:

ipconfig

Look for your default gateway. This is usually the router your device uses to reach other networks.

Next lesson

HTTP & HTTPS.

Next we'll explore how browsers and web servers communicate, and how HTTPS protects data in transit.