TL;DR
Many devices share one public IP because the router keeps a translation table, assigning a port per conversation so every reply finds its way back to the right device.
One public IP, many devices
Who this is for
You've heard "private IP" and "public IP" but never understood how ten devices at home, or hundreds of pods in a cluster, all reach the internet through a single public address.
Public IPv4 addresses are scarce, so we don't give one to every device. Instead, a network uses private addresses internally (like 10.0.0.11) and a router performs NAT, Network Address Translation, rewriting the source address on the way out and reversing it on the way back.
See it
Watch two private hosts share one public IP. Notice the source address on each packet change as it crosses the router, and how the translation table remembers who is who.
NAT, live
NAT translation table
10.0.0.11
private host
10.0.0.12
private host
NAT router
203.0.113.5
Server
the internet
The source address is rewritten at the router. The table maps each public port back to the right private host.
The trick: a port per conversation
If everyone shares one IP, how does a reply find the right device? The router assigns each outbound connection a unique source port on the public side and records the mapping. When a reply arrives for that port, the table says exactly which private host and port to send it to. This is sometimes called PAT (Port Address Translation).
- Outbound: source 10.0.0.11:51000 becomes 203.0.113.5:40001, recorded in the table.
- Inbound reply: arrives for 203.0.113.5:40001, the table maps it back to 10.0.0.11:51000.
- Many devices, one IP: different ports keep thousands of simultaneous conversations apart.
Pro tip
This is also why incoming connections need port forwarding or a load balancer: by default the router only has table entries for conversations a private host started. Nothing outside knows how to reach in unprompted.
Key takeaways
- Private IPs are used internally; NAT translates them to a shared public IP.
- The router rewrites the source address and port on the way out.
- A translation table maps each public port back to the right private host.
- Unique ports are what let one IP serve many devices at once.
- Unsolicited inbound traffic needs explicit forwarding, because there's no table entry for it.
Check your understanding
1. If many devices share one public IP, how does an incoming reply find the right private device?
2. Why do incoming connections need something like port forwarding or a load balancer to reach a device behind NAT?
Frequently asked questions
Why do networks use NAT at all?
Public IPv4 addresses are scarce, so we do not give one to every device. A network uses private addresses internally and a router performs NAT, rewriting the source address on the way out and reversing it on the way back.
How does a reply find the right device when everyone shares one IP?
The router assigns each outbound connection a unique source port on the public side and records the mapping in a translation table. When a reply arrives for that port, the table says exactly which private host and port to send it to, which is why this is also called PAT, Port Address Translation.
Why do incoming connections need port forwarding or a load balancer?
By default the router only has translation table entries for conversations a private host started, so nothing outside knows how to reach in unprompted. Port forwarding or a load balancer creates a way for outside connections to map to an internal device.
Was this article helpful?
Want to learn this properly?
Reading is a start. VPC & cloud networking is a full interactive lesson in the Cloud Engineer path, with real terminal labs, production scenarios, and a completion record.