(A naive/stupid question which I couldn't find answer to on the web.)

Why is the internet traffic reaching me even if I haven't set up port forwarding. (For example, I can view websites). What I have learnt so far is that you have to set up port forwarding to enable traffic from the outside network/internet to get through your router. But why isn't the internet traffic blocked. Why am I able to view webpages?

What am I missing here?


There's one word missing:

You need port forwarding to enable traffic initiated from the outside network/Internet.

When you make a request to an external server, a NAT entry is created in the router NAT table. When the response comes backs, it matches the existing entry and is forwarded to the initiator.

  • so if a packet is tampered to match the existing entry in the NAT table of the router will it be able to pass through the router? – Roshan Rimal Feb 5 '19 at 12:06
  • Yes. Of courses, that means it will be send to the initiator on the original port used by the client, so this crafted packet will be handled by the original initiator, but it could be an attack vector. One more reason to ensure your browser is up to date. – JFL Feb 5 '19 at 12:20

You have hit upon a big problem with NAPT. The NAPT device must maintain a state for connections. It has a table to match incoming packets with outgoing packets.

IP was designed to be a stateless, end-to-end connection. Only the endpoints are supposed to maintain the state. NAPT breaks that paradigm. The connections now depend on an intermediate device to maintain a state. If you have several routers with different paths, and you have asymmetric traffic (return packets come back on a different path), which is not uncommon, then the connection is broken because the return router does not have the state table created by the outbound router.

NAPT is a problem for transport-layer protocols other than TCP, UDP, and ICMP, and there are application-layer protocols that it also breaks. It was created to extend the life of IPv4 until we can all move to IPv6, which has enough addresses to restore the original IP paradigm of every host having a unique address, and the hosts are the ones to maintain the state, not intermediate devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.