Step 38. NAT and Home Routers — The Secret of the Disguise-Managing Doorstep

Level 0 — Getting Comfortable with Computers | Difficulty ★☆☆☆☆ | Estimated time: 2 hours

Prerequisites: Steps through 37 complete; you understand default gateways and tracert. We use Windows PowerShell and a browser.

• What you need: your home router, one computer connected to it, a browser.
• Caution: today has more looking-with-your-eyes practice than commands. Even when you enter the router’s admin page, do not change any settings — in particular, never casually open port forwarding or a DMZ. This section’s rule is “look only.”

Here are two riddles. First, in Step 37 your computer had an address like 192.168.x.x or 172.30.x.x — but the neighbor’s computer can have the exact same address. Addresses overlap, so why doesn’t the mail get tangled? Second, the planet’s internet addresses (IPv4) number only about 4.3 billion, while devices number in the tens of billions. It should run out — so why does everything keep working? The answer to both riddles is this section’s protagonist, NAT, and the equipment doing that work is the router blinking its lights in the corner of your room right now.

1. Learning Objectives

By the end of this unit, you will be able to:

• Recite the three private IP ranges and tell whether a given address is private or public
• Explain NAT’s four steps (swap → record → reply → delivery)
• Check my computer’s private IP and the router’s public IP separately
• Explain that DHCP is a “lease with a deadline,” and find assignment traces in ipconfig /all
• Explain that port forwarding is an exception door in the castle wall, and why it creates exposure

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. Private IP and Public IP — Neighborhood Addresses and World Addresses

There are two kinds of IP addresses:

• Public IP: an address unique in the whole world. The internet’s real address. Assigned by the ISP.
• Private IP: an address used only inside a neighborhood (internal network). Three ranges are designated: 10.x.x.x, 172.16–31.x.x, 192.168.x.x. These addresses cannot be routed on the internet. It’s set that way by rule. They’re like apartment unit numbers — every apartment complex has a Building 101, Unit 502, but no mail carrier can find it from that address alone.

In a common IPv4 home setup, devices use private addresses and an edge device performs translation. Other arrangements include public addresses on hosts, carrier-grade NAT, VPNs, and IPv6. The following diagram is one model, not every network.

2-2. NAT — Disguise and Ledger

We said private IPs can’t be routed from outside. Then how do we view Google? This is where the router performs a disguise:

1. My computer (private IP) writes a letter to Google. Sender: my private IP.
2. The router receives this letter and swaps the sender for its own public IP. And it records in a ledger: “this letter was actually sent by unit number such-and-such.”
3. Google sends its reply to the router’s public IP.
4. The router reads the ledger — “ah, this reply goes to unit number such-and-such” — and delivers it to the right device.

This example is address-and-port translation, often called NAPT or PAT. It lets several internal connections share an external IPv4 address. Translation and firewall filtering are different functions; mapping behavior alone is not a complete security policy.

2-3. DHCP — The Seat Assigner

When a computer connects to the router (by cable or Wi-Fi), the very first thing it does is: “I’m here — give me an address, please.” The router hands out a private IP: “take seat 23.” This automatic assignment system is called DHCP (Dynamic Host Configuration Protocol). It’s like a restaurant host guiding you to an empty seat — thanks to it, we don’t have to type IPs by hand.

DHCP addresses are leased. The client normally attempts renewal before expiry according to lease timers. The server may renew or refuse, and availability or configuration can change the result.

2-4. Port Forwarding — An Exception Door in the Castle Wall

A port-forwarding rule maps an inbound address and port to an internal service. Whether a remote client can use it also depends on upstream reachability, firewall rules, service binding, and any carrier NAT. This unit inspects the concept without opening such a rule.

3. Follow Along

Before you begin. Address translation and firewall policy are different functions. The common home setup translates ports as well as addresses. An external address service shows the egress address it sees, which may belong to a VPN, proxy, or carrier NAT rather than your router.

3-1. Checking My Two Faces — Private IP

First, my name inside the neighborhood:

ipconfig

Ethernet adapter Ethernet:

   IPv4 Address. . . . . . . . . . . : 172.30.1.54
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.1.254

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output: the example computer’s address is 172.30.1.54 — it starts with 172.30, not 192.168. That means it belongs to the second (172.16–31) of the three private ranges. You’ve illustrated that private IPs aren’t only 192.168. Compare which of the three ranges your address belongs to.

3-2. Checking My Two Faces — Public IP

Now let’s check my name as the outside world sees it — the public IP the router disguised:

Invoke-RestMethod -Uri "https://api.ipify.org"

203.0.113.10

Illustrative output. Values, wording, account names, and available fields vary by environment.

The external service reports the source address it observed for that request. It may be a router, carrier-grade NAT, VPN, proxy, or IPv6 egress address. The printed 203.0.113.10 value is a documentation example, not a usable destination. Devices share an observed address only when their traffic uses the same relevant egress path.

Why: confirming “my two faces” in numbers is the starting point of understanding NAT.

3-3. Predict — What About a Virtual Machine’s Public IP?

Prediction: compare the same address family and external service from host and guest. They may share an egress address under the same NAT path, but a VPN, proxy, alternate interface, or IPv6 route can produce a different result.

Answer: the same. The disguise happens at the router, and every device in the house (real or virtual) is under that umbrella. Even from inside a VM, the outside world sees only our home’s main number.

3-4. NAT Reasoning Problem — Fill in the Blanks

More a reasoning exercise than a practice. Write the sequence in your notebook.

Situation: a phone (private 192.168.0.31) opened YouTube.

1. The phone writes a letter to YouTube’s server. Sender: 192.168.0.31.
2. The router swaps the sender to ______.
3. In the router’s ledger, it records “this conversation belongs to unit ______.”
4. When the reply arrives, the router reads the ledger and delivers it to unit ______.

Fill in the blanks. Check the answers in the mission walkthrough in Section 5. These four sentences are the whole of NAT — the technology’s name is grand, but the work is the same as a mail carrier’s delivery memo.

3-5. Checking DHCP Traces — ipconfig /all

Let’s look at the traces of my computer being assigned a seat:

ipconfig /all

Ethernet adapter Ethernet:

   Description . . . . . . . . . . . : Realtek USB GbE Family Controller
   Physical Address. . . . . . . . . : 98-FD-B4-xx-xx-xx
   DHCP Enabled. . . . . . . . . . . : No
   IPv4 Address. . . . . . . . . . . : 172.30.1.54(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.30.1.254
   DNS Servers . . . . . . . . . . . : 168.126.63.1
                                       168.126.63.2

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output — carefully: the example computer shows DHCP Enabled: No. This computer has its address manually fixed, so there are no lease records. On your computer it will mostly say Yes, and below it you’ll likely see lines like these:

• Lease Obtained / Lease Expires — the seat is borrowed, not permanently owned
• DHCP Server — mostly the same as the router’s address. The seat assigner and the gateway live in the same box

Find these items on your own screen. If it says Yes, you’re seeing the physical reality of “a seat the router lent with a deadline”; if it says No, it’s fixed-configured like the example computer — both are normal, and knowing which one you have is this section’s goal.

Why: not “IPs just appear automatically,” but knowing “who assigned it, and in what way” — only then can you later diagnose IP conflicts or assignment failures.

3-6. The Router Admin Page — Our Home’s Control Room

Now let’s see our home’s control room directly. Type the default gateway address into the browser’s address bar (the address you checked in 3-1):

http://172.30.1.254     ← your gateway address

How to read it: the router manufacturer’s login screen appears. It asks for an admin ID and password; if you don’t know them, check the sticker on the back or side of the router — the initial password is often written there. A family member may have changed it, so if it doesn’t work, ask them. It’s fine if you can’t get in — see Wall 1.

Log in and a dashboard appears. Screens differ by manufacturer, but they generally have items like these:

• Connected device list: every device currently attached to this router. Names and private IPs are visible.
• Internet (WAN) info: our home’s public IP.
• Wireless settings: Wi-Fi name and password.
• Port forwarding / virtual server: the exception-door settings.

Read the router list according to its labels: it may show DHCP leases, active neighbors, static entries, or historical records. An unfamiliar row requires investigation; it does not by itself prove an intruder or how the address was assigned.

Caution: do not change any settings. This section’s practice is entirely “looking.” And if the password happens to still be the initial one, that is real-world security rule number one — consider changing it in consultation with your family.

3-7. Private Range Quiz — Grade Yourself

Write the addresses below in your notebook and mark each O (private) or X (public). Check the answers in Section 5.

1. 192.168.1.100
2. 8.8.8.8
3. 10.0.0.5
4. 172.16.3.4
5. 172.33.0.1
6. 172.30.1.54
7. 192.169.0.1

Numbers 5 and 7 are traps. Knowing the boundary numbers precisely is real skill. This distinction is basic calisthenics for reading logs — if you can’t tell at a glance whether an address in a log is “inside our house” or “the outside world,” you can’t begin even the first sentence of breach analysis.

4. Missions & Exercises

Mission — Draw a NAT Map

Next to Step 37’s hop map, continue this section’s map:

1. On the left, draw an oval labeled “our home neighborhood,” and inside it draw the computer and phone with their private IPs (use the real addresses you checked in 3-1)
2. At the oval’s doorstep, draw the router. On its inside face write the gateway address; on its outside face write the public IP from 3-2
3. Above the router, write “NAT: sender swap + ledger record”
4. Draw Google outside and draw two arrows. On the outgoing arrow: “disguised as the public IP.” On the incoming arrow: “read the ledger, deliver to the right device”
5. Draw the translation boundary and the separate firewall policy. Label an inbound forwarding rule as an intentional mapping to a specific internal service; do not enable it for this exercise.

Exercises

Q1. Write the three private IP ranges exactly.

Q2. Explain NAT’s four steps (swap → record → reply → delivery) in the reasoning-problem format of 3-4.

Q3. NAT is an address-saving technology, yet it’s also called an “accidental castle wall.” Why? Also explain why this wall is not all-powerful (what passes through the front gate).

Q4. What is port forwarding, and why does “exposure grow by as much as you open”?

┌──────────── Our home neighborhood ────────────┐
│  Computer 172.30.1.54                         │
│  Phone 172.30.1.xx                            │
│           │                                   │
│      [Router]  ← NAT: sender swap + ledger    │
└───────────┼───────────────────────────────────┘
  Inside face 172.30.1.254 │ Public IP (e.g., 203.0.113.10) Outside face
            │ Outgoing letters: disguised as the public IP
            ▼
         [Google]  ── Reply: read the ledger, deliver to the device ──▶

   Castle wall: anything trying to come in from outside first is blocked by default
   Exception door: port forwarding (exposure grows by as much as you open)

6. Common Pitfalls & Fixes

Wall 1. I can’t log in to the router admin page

Symptom: it keeps rejecting the ID/password you enter.
Cause: a family member has often changed the initial password. It’s a case of trusting only the manufacturer’s default and getting blocked.
Fix: check the sticker on the back of the router first, and if you still don’t know, ask your family. Initialization via the reset button is not recommended, since it wipes the Wi-Fi settings too. At worst you miss the tour — this section’s core practice (checking the two faces and the map) can be completed with commands.

Wall 2. Verification sites like api.ipify.org won’t open

Symptom: the command errors out or the page won’t open.
Cause: a temporary outage, or blocked by network policy.
Fix: searching “what is my ip” in a browser shows the public IP right at the top of the results. There are many tools; the principle is one.

Wall 3. My IP is neither 192.168 nor 10.x — and it’s private?

Symptom: an address begins 172.20 or 172.30. Both fall in the RFC 1918 range 172.16.0.0/12. Addresses outside the three private ranges are not automatically public: loopback, link-local, documentation, multicast, and other special-purpose ranges also exist. An automatic 169.254/16 address can indicate missing DHCP service, but inspect the interface and context.

Wall 4. I want to do port forwarding but it’s scary

Symptom: you want to open a game server or such, but the security warnings intimidate you.
Cause: the right instinct. An open door is exposure.
Fix: at this stage, “knowing why it’s scary” is enough. The practice of opening doors comes after you learn firewalls and service management, inside your own lab environment. The principle doesn’t change — all offensive practice happens only in your own lab and on legal platforms. Unauthorized attacks on live services are a crime. Touching someone else’s router settings falls in that category too.

7. Summary

This section’s Concepts

This section’s Commands

The Instinct That Matters More Than Commands

Until yesterday, the router was “the box that gives off Wi-Fi.” From today, that box is the disguise manager, the mail carrier, and the castle-warden. And this picture is the same in corporate networks, differing only in scale — the main number (public IP), extension numbers (private IPs), the seat assigner (DHCP server). Those who understand a small neighborhood understand a big city.

Remember two more things. First, when ISP addresses also run short, there’s CGNAT (carrier-grade NAT), which gives even the router’s public IP as private — a disguise behind the disguise, one layer deeper, so if you’ve set port forwarding and still can’t connect from outside, suspect this case. Second, “my public IP” you checked today is the whole house’s main number, not your computer’s number. The fact that every device under the same router goes out with the same number — this is why, in log analysis, the question “who is this public IP?” leads to “which device in this house?”

Once every box is checked, Step 38 is complete.