Skip to main content
Back to module
Networking Fundamentals · Core Network Services

DHCP and NAT

Reading20mLesson 2 of 3 in this module

Explain how a home router hands out addresses with DHCP and shares one public address with NAT.

Why it matters

When you join a Wi-Fi network, your phone gets an IP address, a gateway and DNS servers within a second, and then reaches the internet even though dozens of devices in the house share one public address. Two services make that happen: DHCP hands out the settings, and NAT shares the address. Both appear in cloud networks too (managed DHCP options and NAT gateways), and both are common sources of "no internet" problems.

DHCP: automatic configuration

A device needs four settings to use an IP network:

  1. an IP address
  2. a subnet mask
  3. a default gateway (the router that leads off the local network)
  4. one or more DNS servers

Typing these by hand on every device would be slow and error-prone, so the Dynamic Host Configuration Protocol does it. On a home network, the DHCP server is built into the router.

DORA: the four-message exchange

DHCP uses UDP (server port 67, client port 68). A device that has no address yet goes through DORA:

  1. Discover: the client broadcasts "is there a DHCP server?" (it has no address, so it sends from 0.0.0.0 to 255.255.255.255).
  2. Offer: the server offers an address, for example 192.168.1.23, plus mask, gateway and DNS.
  3. Request: the client broadcasts "I'd like 192.168.1.23", so other servers know their offers were declined.
  4. Acknowledge: the server confirms, and the client starts using the address.

Leases

Addresses are leased, not given forever. A typical home lease is 24 hours. The client renews at about halfway through. When devices leave, their addresses return to the pool. A router often hands out a range such as 192.168.1.100 to 192.168.1.199.

A reservation (static lease) makes the router always give the same address to one device's MAC address, which is handy for a printer or a home server.

If no server answers, the device gives itself a 169.254.x.x address and cannot reach the internet. That address is a strong clue that DHCP failed.

NAT: sharing one public address

Your ISP usually gives your home one public IPv4 address. Inside, devices use private RFC 1918 addresses such as 192.168.1.x, which are not routable on the internet. Network Address Translation (NAT) on the router rewrites addresses as traffic leaves and returns.

The form used at home is PAT (port address translation, also called NAT overload): many inside devices share the one public address, told apart by port numbers.

Worked example: the NAT table

Your public address is 203.0.113.7. Two devices browse at the same time:

Inside (private)        ->  Outside (public)          ->  Server
192.168.1.23:52814      ->  203.0.113.7:40001         ->  93.184.215.14:443
192.168.1.40:52814      ->  203.0.113.7:40002         ->  93.184.215.14:443

Both devices happened to pick source port 52814. The router rewrites each to a unique public port and records the mapping. When a reply arrives at 203.0.113.7:40002, the router looks it up and forwards it to 192.168.1.40:52814.

Side effects of NAT

  • Inbound connections are blocked by default. An outside device cannot start a connection to 192.168.1.40 because the router has no mapping for it. This acts like a basic firewall, but it is not a security control to rely on.
  • Port forwarding creates a permanent mapping (for example public port 8443 to 192.168.1.50:443) to expose one inside service. Do it only when you understand the risk.
  • Carrier-grade NAT (CGNAT): some ISPs put customers behind another layer of NAT, so your router's "WAN" address may itself be private (often in 100.64.0.0/10).
  • IPv6 has enough addresses that NAT is generally not needed; firewalls do the filtering.

In the cloud

A cloud virtual network uses private subnets too. Instances in a private subnet reach the internet through a NAT gateway, which lets them download updates while blocking inbound connections. NAT gateways are usually billed per hour and per gigabyte, so they are a common surprise on a cloud bill.

Common mistakes

  • Setting a static IP inside the DHCP pool. The router may later hand the same address to another device, causing an address conflict. Use a reservation or an address outside the pool.
  • Running two DHCP servers on one network (for example, a second router left in router mode). Devices get conflicting gateways.
  • Confusing your private and public addresses. ipconfig/ip addr shows the private one; a "what is my IP" site shows the public one.
  • Treating NAT as a firewall. Keep a real firewall enabled.

Quick recap

  • DHCP gives devices an address, mask, gateway and DNS servers via Discover, Offer, Request, Acknowledge, on a lease.
  • NAT (PAT) lets many private addresses share one public address by rewriting ports.
  • 169.254.x.x means DHCP failed; inbound traffic needs port forwarding through NAT.
Also in this lesson: