I wondering how does ISP open door for incoming answer from a requesting site since the answer doesn't come from the requesting door, and how to achieve my computer IP since it's behind ISP firewall, and it uses a shared IP.
Assuming the ISP is using carrier-grade NAT (CGN) to route between private IP addresses and the public Internet, the NAT router needs to be stateful - it needs to track all transport-layer connections.
It must remember which remote/local IP/port combination on its public interface map to which private IP/port combination.
- client sends SYN from private a.b.c.d:TCP34567 (source) to public server w.x.y.z:TCP80 (destination)
- NAT router creates a new entry in its mapping table and replaces the source a.b.c.d:TCP34567 with its own public e.f.g.h:TCP65432 and forwards the packet
- the public server replies with SYN/ACK to e.f.g.h:TCP65432
- NAT router looks up the mapping in its table and replaces the destination with the original a.b.c.d:TCP34567 when forwarding back to client
- client receives SYN from public server
This repeats for each packet sent between client and server. When the socket is finally closed (or times out), the NAT router deletes the entry from its NAT table.