Every host on the Internet has to have a unique routable IP address, or else it would not be considered a host on the Internet. For various reasons, people have started to use tricks to get more IP addresses. ISPs often give an end user only one IP address, while those end users want to connect more than one computer. The trick mostly deployed now is Network Address Translation (NAT, sometimes also called NAPT). The end user connects these computers together using internal IP addresses. On the machine that is actually connected to the Internet, which could be a phone, cable or DSL line, the real globally routable IP address is configured. This is the IP address that everyone on the Internet can talk to. The address is given out by the ISP.

This computer, technically speaking now acting as a router, takes incoming packets from the LAN's private IP addresses, and rewrites these packets so they appear to come from its own real IP address. It remembers which local machine these packets were translated for. When the remote machine it were trying to reach answers, that machine thinks it is talking to the router. Once the router receives the response packet, it matches it with the list of local computers and their network connections, and translates the destination IP address back to the local machine's private IP address and sends the packets onto the local network.

Of course, there is one problem. A remote machine cannot reach the local machine behind the router, since it has no public routable IP address. It cannot just connect to the public IP address either, because the router would have no idea for whom this packet was intended, since no local machine has initiated the communication.

People began to see this as more than a shortcoming. After all, this setup is ideal for protecting those internal machines. Since the world cannot reach them, no hackers or viruses could ever reach them either. It sort of works like a firewall, and this is why you often see NAT and firewalls combined on one device. All common DSL and cable modem routers can do NAT and firewalling.