Chapter 12 — Private addresses and NAT

Practice (20 min)

A. See both of your addresses:

# your PRIVATE address (what your device thinks it is)
ip -4 addr show | grep inet        # Linux
ipconfig getifaddr en0             # macOS

# your PUBLIC address (what the internet sees)
curl -s ifconfig.me ; echo

They're different. Everyone in your house shows the same public one. Try it on your phone (on Wi-Fi) to confirm.

B. Find your router's NAT table (if it's a Linux box or you can log into your home router's web UI — look for "NAT", "connections", or "active sessions"):

# On a Linux machine acting as a router:
sudo conntrack -L | head

C. Prove NAT blocks inbound. Start a simple server on your laptop:

python3 -m http.server 8000

• From another device in your house: http://<your-private-ip>:8000 → works.
• From outside (mobile data, or ask a friend): http://<your-public-ip>:8000 → fails, because no NAT mapping exists. That's the accidental firewall.

D. Check whether you're behind CGNAT: compare curl ifconfig.me with the WAN address shown in your router's admin page. If your router's WAN address is in 100.64.x.x–100.127.x.x, you are behind carrier-grade NAT.

Build it in Go (15 min) — see your own NAT

Two questions decide whether you're behind NAT: what address does my machine think it has? and what address does the internet see? This program asks both.

// whoami: show the NAT in front of you by comparing the address your machine
// THINKS it has with the address the internet SEES.
//
//	go run ./whoami
package main

import (
	"context"
	"fmt"
	"io"
	"net"
	"net/http"
	"strings"
	"time"
)

func main() {
	// 1. Which local address would the kernel use to reach the internet?
	//    "Dialing" UDP sends no packets -- it only asks the kernel to pick a
	//    route and a source address, which we can then read back.
	c, err := net.Dial("udp", "1.1.1.1:53")
	if err != nil {
		fmt.Println("no route to the internet:", err)
		return
	}
	local := c.LocalAddr().(*net.UDPAddr).IP
	c.Close()
	fmt.Println("private (what you think you are): ", local)

	// 2. Ask a server on the internet which address our packets arrived from.
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	req, _ := http.NewRequestWithContext(ctx, "GET", "https://api.ipify.org", nil)
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		fmt.Println("could not reach api.ipify.org:", err)
		return
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(io.LimitReader(resp.Body, 64))
	public := net.ParseIP(strings.TrimSpace(string(body)))
	fmt.Println("public  (what the internet sees): ", public)

	// 3. Interpret.
	switch {
	case public == nil:
		fmt.Println("unexpected answer:", string(body))
	case local.Equal(public):
		fmt.Println("=> no NAT: your machine holds a public address directly")
	case isCGNAT(local):
		fmt.Println("=> carrier-grade NAT: even your 'router' address is shared (100.64.0.0/10)")
	default:
		fmt.Println("=> NAT: a router rewrote your source address on the way out")
	}
}

func isCGNAT(ip net.IP) bool {
	_, cgnat, _ := net.ParseCIDR("100.64.0.0/10")
	return cgnat.Contains(ip)
}

$ go run ./whoami
private (what you think you are):  192.168.1.2
public  (what the internet sees):  122.171.18.134
=> NAT: a router rewrote your source address on the way out

What to notice: net.Dial("udp", ...) sends no packet. UDP has no handshake, so "connecting" a UDP socket only asks the kernel to pick a route and a source address. Reading LocalAddr() afterwards is a standard trick for finding "my outbound IP" without parsing routing tables.

Exercises:

1. Run it on home Wi-Fi, then on a phone hotspot. On mobile networks you'll often get the carrier-grade NAT result (100.64.0.0/10), or a public address that thousands of other customers share at the same moment.
2. Run it inside a Docker container (docker run --rm -v "$PWD":/w -w /w golang:1.26 go run ./whoami). You'll see an extra layer of NAT: container → host → router.
3. Why does this matter for software? Read the "rate limiting by IP" point in the OSI guide's Layer 3 chapter, then decide what your service should use as a client identity.