NAT and DHCP: how devices on your network get online

DHCP (Dynamic Host Configuration Protocol) gives each device that joins a network its settings: an IP address, a subnet mask, a default gateway and DNS servers. NAT (network address translation) rewrites addresses as traffic leaves the network, so many devices with private addresses can share one public IPv4 address.

A home router usually does both, which is why they are often explained together. They are separate jobs, though: DHCP configures a device when it joins the network, and NAT translates every packet that crosses the router.

Addresses are leased for a set time. A client normally renews when half the lease has passed, so a device that stays on the network keeps its address. Routers can also reserve a fixed address for a device such as a printer. If no DHCP server answers, the device gives itself a link-local address from 169.254.0.0/16, which is a sign that DHCP failed.

Getting the first lease takes four messages, known as DORA. Clients use UDP port 68 and servers use port 67, and the client starts with broadcasts because it has no address yet:

The router keeps a translation table. When a device inside sends a packet out, the router replaces the private source address and port with its own public address and a port it picks. It records the mapping, and when a reply arrives, it looks the mapping up and rewrites the destination back.

Changing the port as well as the address is what allows many devices to hold thousands of connections through one public address. This form is called port address translation (PAT) or NAPT, and it is what home routers do.

Mappings expire when a connection goes quiet, usually much sooner for UDP than for TCP. Long-lived connections that sit idle, such as a VPN or a WebSocket, send keepalive packets so the router does not drop the mapping.

A NAT router only creates mappings for connections started from inside. A packet that arrives from the internet unprompted matches no mapping, and the router drops it because it cannot tell which device should get it.

Running a game server, camera or self-hosted app at home takes a port forward. That is a fixed rule sending one public port, such as TCP 8443, to an internal address and port. UPnP and PCP (Port Control Protocol) allow applications to create these rules automatically, which is convenient but means any program on the network can open a path inward.

Peer-to-peer apps such as video calls work around NAT without port forwards. They use STUN to learn their public address and port, then try to reach each other directly, a technique called hole punching. When that fails, they relay traffic through a TURN server.

NAT drops unsolicited packets as a side effect of how mappings work. It inspects nothing, and a port forward exposes the device behind it directly, so a stateful firewall is still what enforces security policy.

Short of IPv4 addresses, many ISPs put customers behind carrier-grade NAT (CGNAT). Your router's WAN address is then a private or shared address, often from 100.64.0.0/10, and the ISP translates your traffic a second time before it reaches the internet.

Port forwarding on your own router has no effect behind CGNAT, because the ISP's NAT drops inbound traffic first. If the WAN address your router shows differs from the address websites see for you, you are probably behind CGNAT. The options are a public IPv4 address from the ISP, IPv6, or a tunnel or relay service.

Sharing one public address also means that IP-based rate limits and blocks aimed at one customer can affect others on the same address.

IPv6 removes the need for NAT. Each device gets a globally routable address, often through SLAAC rather than DHCP, and the router's firewall decides which inbound connections to allow. Hosting at home over IPv6 means opening the firewall for one address and port instead of setting up a forward.