Step 38. NAT and Home Routers — The Secret of the Disguise-Managing Doorstep

Level 0 — Getting Comfortable with Computers | Difficulty ★☆☆☆☆ | Estimated time: 2 hours

Prerequisites: Steps through 37 complete; you understand default gateways and tracert. We use Windows PowerShell and a browser.

• What you need: your home router, one computer connected to it, a browser.
• Caution: today has more looking-with-your-eyes practice than commands. Even when you enter the router’s admin page, do not change any settings — in particular, never casually open port forwarding or a DMZ. Today’s rule is "look only."

Here are two riddles. First, in Step 37 your computer had an address like 192.168.x.x or 172.30.x.x — but the neighbor’s computer can have the exact same address. Addresses overlap, so why doesn’t the mail get tangled? Second, the planet’s internet addresses (IPv4) number only about 4.3 billion, while devices number in the tens of billions. It should run out — so why does everything keep working? The answer to both riddles is today’s protagonist, NAT, and the equipment doing that work is the router blinking its lights in the corner of your room right now.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Recite the three private IP ranges and tell whether a given address is private or public
• Explain NAT’s four steps (swap → record → reply → delivery)
• Check my computer’s private IP and the router’s public IP separately
• Explain that DHCP is a "lease with a deadline," and find assignment traces in ipconfig /all
• Explain that port forwarding is an exception door in the castle wall, and why it creates exposure

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Private IP and Public IP — Neighborhood Addresses and World Addresses

There are two kinds of IP addresses:

• Public IP: an address unique in the whole world. The internet’s real address. Assigned by the ISP.
• Private IP: an address used only inside a neighborhood (internal network). Three ranges are designated: 10.x.x.x, 172.16–31.x.x, 192.168.x.x. These addresses cannot be routed from outside the internet. It’s set that way by rule. They’re like apartment unit numbers — every apartment complex has a Building 101, Unit 502, but no mail carrier can find it from that address alone.

Your computer holds a private IP, and only the router holds a public IP. Think of a house phone’s one main number and each room’s extension number.

2-2. NAT — Disguise and Ledger

We said private IPs can’t be routed from outside. Then how do we view Google? This is where the router performs a disguise:

1. My computer (private IP) writes a letter to Google. Sender: my private IP.
2. The router receives this letter and swaps the sender for its own public IP. And it records in a ledger: "this letter was actually sent by unit number such-and-such."
3. Google sends its reply to the router’s public IP.
4. The router reads the ledger — "ah, this reply goes to unit number such-and-such" — and delivers it to the right device.

This swapping and the record ledger are called NAT (Network Address Translation). Thanks to it, no matter how many devices are in the house, they all use the internet through one public IP — the secret of how tens of billions of devices live on 4.3 billion addresses. And there’s a bonus. Since outsiders can’t route to our home’s private IPs, anything trying to come in from outside first is blocked by default. The router ends up playing the role of a kind of castle wall.

2-3. DHCP — The Seat Assigner

When a computer connects to the router (by cable or Wi-Fi), the very first thing it does is: "I’m here — give me an address, please." The router hands out a private IP: "take seat 23." This automatic assignment system is called DHCP (Dynamic Host Configuration Protocol). It’s like a restaurant host guiding you to an empty seat — thanks to it, we don’t have to type IPs by hand.

One important detail: this seat is not permanent ownership but a lease with a deadline. Before it expires, the router automatically renews it for you.

2-4. Port Forwarding — An Exception Door in the Castle Wall

Sometimes it’s a problem that every road from outside in is blocked. Say you want a friend to connect to a game server you built. For that, you write one rule on the router: "when something arrives at the main number’s port 25565, connect it to unit such-and-such’s port 25565." This is port forwarding. Since it’s opening one small door in the castle wall, exposure grows by exactly as much as you open. It connects precisely with Step 34’s tension: "an open door is exposure."

3. Follow Along

3-1. Checking My Two Faces — Private IP

First, my name inside the neighborhood:

ipconfig

Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 172.30.1.54
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.1.254

(Measured 2026-09-09. Your addresses will differ.)

How to read the output: the measured computer’s address is 172.30.1.54 — it starts with 172.30, not 192.168. That means it belongs to the second (172.16–31) of the three private ranges. You’ve confirmed by measurement that private IPs aren’t only 192.168. Compare which of the three ranges your address belongs to.

3-2. Checking My Two Faces — Public IP

Now let’s check my name as the outside world sees it — the public IP the router disguised:

Invoke-RestMethod -Uri "https://api.ipify.org"

203.0.113.10

(Measured 2026-09-09. In reality, only one number is printed — your home’s public IP assigned by the ISP. The value above is altered into the documentation example range (203.0.113.x) because it’s personal information.)

How to read the output: a completely different address came out, belonging to none of the three private ranges. This is our home’s main number — the router’s public IP. Try the same check on another device next to you (a laptop, a phone) — searching "what is my ip" in a browser works too. The same address will come out. That’s because every device in the house goes out disguised under this one main number.

Why: confirming "my two faces" in numbers is the starting point of understanding NAT.

3-3. Predict — What About a Virtual Machine’s Public IP?

Prediction: if you run the same check (curl ifconfig.me) in an Ubuntu virtual machine, will the public IP be the same as Windows’, or different? Hint: the VM ultimately goes out through the same router.

Answer: the same. The disguise happens at the router, and every device in the house (real or virtual) is under that umbrella. Even from inside a VM, the outside world sees only our home’s main number.

3-4. NAT Reasoning Problem — Fill in the Blanks

More a reasoning exercise than a practice. Write the sequence in your notebook.

Situation: a phone (private 192.168.0.31) opened YouTube.

1. The phone writes a letter to YouTube’s server. Sender: 192.168.0.31.
2. The router swaps the sender to ______.
3. In the router’s ledger, it records "this conversation belongs to unit ______."
4. When the reply arrives, the router reads the ledger and delivers it to unit ______.

Fill in the blanks. Check the answers in the mission walkthrough in section 5. These four sentences are the whole of NAT — the technology’s name is grand, but the work is the same as a mail carrier’s delivery memo.

3-5. Checking DHCP Traces — ipconfig /all

Let’s look at the traces of my computer being assigned a seat:

ipconfig /all

Ethernet adapter Ethernet:

   Description . . . . . . . . . . . : Realtek USB GbE Family Controller
   Physical Address. . . . . . . . . : 98-FD-B4-xx-xx-xx
   DHCP Enabled. . . . . . . . . . . : No
   IPv4 Address. . . . . . . . . . . : 172.30.1.54(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.1.254
   DNS Servers . . . . . . . . . . . : 168.126.63.1
                                       168.126.63.2

(Measured 2026-09-09, key items only. The tail of the physical address (MAC) is altered. On Korean Windows these appear as DHCP 사용함, 기본 게이트웨이, DNS 서버.)

How to read the output — carefully: the measured computer shows DHCP Enabled: No. This computer has its address manually fixed, so there are no lease records. On your computer it will mostly say Yes, and below it you’ll likely see lines like these:

• Lease Obtained / Lease Expires — the seat is borrowed, not permanently owned
• DHCP Server — mostly the same as the router’s address. The seat assigner and the gateway live in the same box

Find these items on your own screen. If it says Yes, you’re seeing the physical reality of "a seat the router lent with a deadline"; if it says No, it’s fixed-configured like the measured computer — both are normal, and knowing which one you have is today’s goal.

Why: not "IPs just appear automatically," but knowing "who assigned it, and in what way" — only then can you later diagnose IP conflicts or assignment failures.

3-6. The Router Admin Page — Our Home’s Control Room

Now let’s see our home’s control room directly. Type the default gateway address into the browser’s address bar (the address you checked in 3-1):

http://172.30.1.254     ← your gateway address

How to read it: the router manufacturer’s login screen appears. It asks for an admin ID and password; if you don’t know them, check the sticker on the back or side of the router — the initial password is often written there. A family member may have changed it, so if it doesn’t work, ask them. It’s fine if you can’t get in — see Wall 1.

Log in and a dashboard appears. Screens differ by manufacturer, but they generally have items like these:

• Connected device list: every device currently attached to this router. Names and private IPs are visible.
• Internet (WAN) info: our home’s public IP.
• Wireless settings: Wi-Fi name and password.
• Port forwarding / virtual server: the exception-door settings.

Reading the connected device list: is my computer’s private IP there? You’ll also see phones, TVs, family members’ devices. Each was assigned a seat via DHCP. If there’s a device you don’t know, it may belong to someone who knows the Wi-Fi password, or it may be a past connection record. This list — "who is in our neighborhood?" — later becomes the first tool for watching "is there an intruder?"

Caution: do not change any settings. Today’s practice is entirely "looking." And if the password happens to still be the initial one, that is real-world security rule number one — consider changing it in consultation with your family.

3-7. Private Range Quiz — Grade Yourself

Write the addresses below in your notebook and mark each O (private) or X (public). Check the answers in section 5.

1. 192.168.1.100
2. 8.8.8.8
3. 10.0.0.5
4. 172.16.3.4
5. 172.33.0.1
6. 172.30.1.54
7. 192.169.0.1

Numbers 5 and 7 are traps. Knowing the boundary numbers precisely is real skill. This distinction is basic calisthenics for reading logs — if you can’t tell at a glance whether an address in a log is "inside our house" or "the outside world," you can’t begin even the first sentence of breach analysis.

4. Missions & Exercises

Mission — Draw a NAT Map

Next to Step 37’s hop map, continue today’s map:

1. On the left, draw an oval labeled "our home neighborhood," and inside it draw the computer and phone with their private IPs (use the real addresses you checked in 3-1)
2. At the oval’s doorstep, draw the router. On its inside face write the gateway address; on its outside face write the public IP from 3-2
3. Above the router, write "NAT: sender swap + ledger record"
4. Draw Google outside and draw two arrows. On the outgoing arrow: "disguised as the public IP." On the incoming arrow: "read the ledger, deliver to the right device"
5. Draw a castle wall and write: "Anything trying to come in from outside first is blocked by default. Exception door = port forwarding."

Exercises

Q1. Write the three private IP ranges exactly.

Q2. Explain NAT’s four steps (swap → record → reply → delivery) in the reasoning-problem format of 3-4.

Q3. NAT is an address-saving technology, yet it’s also called an "accidental castle wall." Why? Also explain why this wall is not all-powerful (what passes through the front gate).

Q4. What is port forwarding, and why does "exposure grow by as much as you open"?

┌──────────── Our home neighborhood ────────────┐
│  Computer 172.30.1.54                         │
│  Phone 172.30.1.xx                            │
│           │                                   │
│      [Router]  ← NAT: sender swap + ledger    │
└───────────┼───────────────────────────────────┘
  Inside face 172.30.1.254 │ Public IP (e.g., 203.0.113.10) Outside face
            │ Outgoing letters: disguised as the public IP
            ▼
         [Google]  ── Reply: read the ledger, deliver to the device ──▶

   Castle wall: anything trying to come in from outside first is blocked by default
   Exception door: port forwarding (exposure grows by as much as you open)

6. Common Pitfalls & Fixes

Wall 1. I can’t log in to the router admin page

Symptom: it keeps rejecting the ID/password you enter.
Cause: a family member has often changed the initial password. It’s a case of trusting only the manufacturer’s default and getting blocked.
Fix: check the sticker on the back of the router first, and if you still don’t know, ask your family. Initialization via the reset button is not recommended, since it wipes the Wi-Fi settings too. At worst you miss the tour — today’s core practice (checking the two faces and the map) can be completed with commands.

Wall 2. Verification sites like api.ipify.org won’t open

Symptom: the command errors out or the page won’t open.
Cause: a temporary outage, or blocked by network policy.
Fix: searching "what is my ip" in a browser shows the public IP right at the top of the results. There are many tools; the principle is one.

Wall 3. My IP is neither 192.168 nor 10.x — and it’s private?

Symptom: the ipconfig result looks like 172.20.x.x or 172.30.x.x.
Cause: there are three private IP ranges. 172.16–31 is the second one. The measured computer’s 172.30.1.54 was also a private address in exactly this range (measured 2026-09-09).
Fix: just remember the three ranges. Addresses outside them are public. However, an address starting with 169.254 is a DHCP failure signal — recall Step 36’s diagnostic ladder.

Wall 4. I want to do port forwarding but it’s scary

Symptom: you want to open a game server or such, but the security warnings intimidate you.
Cause: the right instinct. An open door is exposure.
Fix: at this stage, "knowing why it’s scary" is enough. The practice of opening doors comes after you learn firewalls and service management, inside your own lab environment. The principle doesn’t change — all offensive practice happens only in your own lab and on legal platforms. Unauthorized attacks on live services are a crime. Touching someone else’s router settings falls in that category too.

7. Summary

Today’s Concepts

Today’s Commands

The Instinct That Matters More Than Commands

Until yesterday, the router was "the box that gives off Wi-Fi." From today, that box is the disguise manager, the mail carrier, and the castle-warden. And this picture is the same in corporate networks, differing only in scale — the main number (public IP), extension numbers (private IPs), the seat assigner (DHCP server). Those who understand a small neighborhood understand a big city.

Remember two more things. First, when ISP addresses also run short, there’s CGNAT (carrier-grade NAT), which gives even the router’s public IP as private — a disguise behind the disguise, one layer deeper, so if you’ve set port forwarding and still can’t connect from outside, suspect this case. Second, "my public IP" you checked today is the whole house’s main number, not your computer’s number. The fact that every device under the same router goes out with the same number — this is why, in log analysis, the question "who is this public IP?" leads to "which device in this house?"

Once every box is checked, Step 38 is complete.