NAT and firewalls

The IP addresses lesson established that 192.168.x.x, 10.x.x.x, and similar ranges are unroutable on the public internet — no router out there will forward a packet to them. Network Address Translation (NAT), running on your router, is what makes internet access work anyway: it rewrites your private source IP to the router's one public IP as traffic leaves, and rewrites the reply back to the right private device on the way in.

The router keeps a temporary table mapping its own public-facing port back to the specific private device and port that made the request — this is exactly why outbound connections "just work" from behind NAT, but nothing on the public internet can initiate a connection to your laptop directly: there's no existing table entry for the router to translate against, only real replies to connections your own network started.

Any server you actually want the public internet to reach — a web app, an API — needs either a real public IP or to sit behind something (a load balancer, a cloud provider's NAT gateway configured for inbound rules) that explicitly allows inbound connections through. This is exactly why a new cloud VM is unreachable by default until you configure it — NAT and default-deny firewall rules (next section) both assume "nothing unsolicited gets in" until you say otherwise.

NAT is about address translation; a firewall is a separate, explicit set of rules deciding what traffic is allowed through at all, regardless of translation. A typical rule looks like: "allow inbound TCP on port 443 from anywhere; allow inbound TCP on port 22 only from this specific IP range; deny everything else inbound by default."

Default deny is the security-conscious default nearly every real system should start from: explicitly allow only what's needed, rather than allowing everything and trying to remember to block the dangerous parts later. A misconfigured cloud security group left wide open (0.0.0.0/0 on a database port, say) is a genuinely common, serious real-world breach cause — directly relevant to both the Web Security and Cloud Computing domains.

A stateless firewall evaluates every packet in isolation against its rule list. A stateful firewall (the norm today) tracks which connections were already permitted, and automatically allows the return traffic for an already-allowed outbound connection without needing a separate explicit inbound rule for it — the same underlying idea as NAT's table, applied to permissions instead of addresses.