Network Address Translation lets several private devices communicate through one public IPv4 address. It became essential as IPv4 space grew scarce. NAT changes address and port information, while a separate firewall policy decides which traffic is allowed.
Outbound connections
When a device opens a connection, the router creates a table entry linking the private address and source port to a public port. Returning packets match that entry and are sent to the originating device. Unmatched inbound packets usually have no destination mapping.
Port forwarding
A forwarding rule creates a predictable mapping for incoming traffic. It is useful for a self-hosted game or service, but it exposes that service to internet scanning. Forward only the required port to the intended device and keep the application patched.
NAT is not the firewall
Address translation can incidentally block unsolicited traffic because no mapping exists, but it was not designed as a complete security policy. Stateful firewalls inspect connection state and apply explicit rules. IPv6 networks normally rely on firewalls without needing address translation.
When applications struggle
Peer-to-peer games, voice calls and remote access may need NAT traversal. UPnP can create mappings automatically, which is convenient but reduces visibility. Manual rules, relays or outbound tunnels offer more control when reliability and security matter.
Practical checklist
- List every manual forwarding rule.
- Disable rules for services you stopped using.
- Restrict source networks where the router supports it.
- Treat UPnP as a convenience setting worth reviewing.
Keep the result in context
Network tools provide useful evidence, not a complete identity or security verdict. Record what you tested, compare results before and after a change, and use several independent signals when a decision matters.
Browse all 25 KiwiVPN guides or return to the public IP checker.