Two address spaces
Private does not mean disconnected.
A phone, laptop, or smart TV can use a private address inside a home or office. That address is meaningful on the local network, but it is not normally advertised as a public destination on the Internet.
A gateway such as a home router can translate the conversation as it crosses the boundary. Many private devices can share one public address while the gateway keeps track of their connections.
Build the model
Four boundary ideas
Private address
Identifies a device inside a local network, such as 192.168.1.24.
Gateway
Connects the local network to another network and manages the boundary.
Translation
Maps local traffic to a public-facing flow and tracks the return path.
CGNAT (Carrier-Grade NAT)
Places another translation layer inside the provider network, so customers may share a public address.
Remember the conversation
NAT keeps a temporary translation entry.
When a private device starts a connection, the gateway records enough of the flow to identify it later: the local address and port, the translated public address and port, the remote destination, and the transport protocol. This entry is often called a NAT mapping or state entry.
When return traffic arrives, the gateway matches it to that entry and rewrites it back toward the private device. The entry is temporary: it is refreshed while the flow is active and eventually expires after inactivity or connection teardown.
Mini experiment
Watch a connection cross the boundary
Choose a local device. The simplified view shows what the gateway presents outside the network.
Ready. Choose a device, then cross the boundary.
Knowledge check
Test your boundary model
Answer five questions. The answer order changes each time.