One public IP, many devices
Who this is for
You've heard "private IP" and "public IP" but never understood how ten devices at home, or hundreds of pods in a cluster, all reach the internet through a single public address.
Public IPv4 addresses are scarce, so we don't give one to every device. Instead, a network uses private addresses internally (like 10.0.0.11) and a router performs NAT, Network Address Translation, rewriting the source address on the way out and reversing it on the way back.
See it
Watch two private hosts share one public IP. Notice the source address on each packet change as it crosses the router, and how the translation table remembers who is who.
NAT, live
NAT translation table
10.0.0.11
private host
10.0.0.12
private host
NAT router
203.0.113.5
Server
the internet
The source address is rewritten at the router. The table maps each public port back to the right private host.
The trick: a port per conversation
If everyone shares one IP, how does a reply find the right device? The router assigns each outbound connection a unique source port on the public side and records the mapping. When a reply arrives for that port, the table says exactly which private host and port to send it to. This is sometimes called PAT (Port Address Translation).
- Outbound: source 10.0.0.11:51000 becomes 203.0.113.5:40001, recorded in the table.
- Inbound reply: arrives for 203.0.113.5:40001, the table maps it back to 10.0.0.11:51000.
- Many devices, one IP: different ports keep thousands of simultaneous conversations apart.
Pro tip
This is also why incoming connections need port forwarding or a load balancer: by default the router only has table entries for conversations a private host started. Nothing outside knows how to reach in unprompted.
Key takeaways
- Private IPs are used internally; NAT translates them to a shared public IP.
- The router rewrites the source address and port on the way out.
- A translation table maps each public port back to the right private host.
- Unique ports are what let one IP serve many devices at once.
- Unsolicited inbound traffic needs explicit forwarding, because there's no table entry for it.
Want to go deeper?
This article covers concepts taught hands-on in the Cloud Engineer and DevOps career paths, with real terminal labs, production scenarios, and structured lessons.