IP addresses, ports and the shape of a connectio

Updated: Oct 28, 2026

Every device that talks on a network needs an address so that replies can find their way back. On the internet that address is an IP address, and a connection between two programs is defined by two addresses and two port numbers. Those four values explain a great deal of everyday networking: why your home has one public address but many devices, why a web server and a mail server can share a machine, why a firewall talks about “opening ports”, and why the address a website sees is not the one your laptop shows.

How addresses and ports route a connection

An IPv4 address is four numbers from 0 to 255 separated by dots, such as 203.0.113.42. That format gives about 4.3 billion addresses, which ran out years ago. IPv6 addresses are far longer, written in hexadecimal groups like 2001:db8::1a2f, and provide effectively unlimited addresses. Both are in use today; most devices have one of each, and the network chooses automatically.

Addresses are divided into public, which are unique across the whole internet and assigned to your internet provider, and private, ranges such as 192.168.x.x and 10.x.x.x that anyone can use inside their own network and that are never routed on the internet. Your router holds one public address on its internet side and hands out private addresses to the devices inside your home.

The trick that makes this work is Network Address Translation (NAT). When your laptop at 192.168.1.20 sends a request, the router rewrites the source to its own public address and remembers the mapping. When the reply arrives, it rewrites the destination back and forwards it to the laptop. From the outside, every device in your house appears to share one address. NAT was invented to stretch IPv4; IPv6 has enough addresses to give every device a public one, though home routers still filter incoming traffic by default.

Ports: many conversations per address

An address gets traffic to a machine. A port, a number from 0 to 65535, gets it to the right program on that machine. Servers listen on well-known ports so clients know where to connect: 80 for HTTP, 443 for HTTPS, 22 for SSH, 25 and 587 for sending email, 53 for DNS. When your browser connects to a website, it picks a random high port on your side, say 51234, and connects to port 443 on the server. The connection is fully identified by the tuple (your address, 51234, server address, 443). Open twenty tabs to the same site and each gets a different local port, which is how the replies are kept apart.

Ports are also what firewalls filter. “Opening port 22” on a server means allowing inbound connections to the SSH program. A home router’s NAT effectively closes all inbound ports, because unsolicited packets have no mapping to forward to. Port forwarding creates a permanent mapping so that, for example, a game server or camera inside the house can be reached from outside, and it should be done sparingly because it exposes that device to the whole internet.

Everyday examples

• “What is my IP” websites show your router’s public address, not your device’s private one.
• A website can geolocate your public address to roughly a city, because address blocks are allocated to providers by region.
• Two people in the same house appear identical to a website; a ban on “your IP” affects everyone on the connection.
• Your public address often changes when the router reconnects, unless you pay for a static one.
• A VPN replaces the public address websites see with the VPN server’s address.
• A message like “connection refused on port 3306” means the machine was reachable but nothing was listening on that port, or a firewall blocked it.

Finding and checking your own IP address

• Do not forward ports on a home router unless you understand what will be reachable; prefer a VPN or a vendor’s relay service to reach devices at home.
• On servers, run a firewall that allows only the ports you actually serve, and move administrative services such as SSH behind key authentication.
• When troubleshooting, separate “can I reach the address” (ping, traceroute) from “is the port open” (a connection test). They fail for different reasons.
• Remember that your public address identifies your household or office to websites; it is not anonymous.
• Enable IPv6 if your provider offers it; modern systems handle it transparently and it avoids some NAT complications.

Frequently asked questions

Can someone hack me if they know my IP address?

Knowing the address alone gives them a target, not access. A properly configured router with no forwarded ports presents nothing to connect to. The realistic risks are denial-of-service floods against gamers and streamers, and geolocation to a city.

Why do I have two IP addresses?

One is your device’s private address on the local network; the other is the router’s public address on the internet. You may also have IPv4 and IPv6 versions of each.

What is localhost?

127.0.0.1 (and ::1) is a special address that always refers to the machine itself. Programs use it to talk to services on the same computer without touching the network.

An address finds the machine, a port finds the program, and the four together define a connection.

In short: IP addresses identify machines, ports identify programs, and NAT lets many private devices share one public address. Firewalls and routers work by deciding which address-and-port combinations may connect, which is why opening ports is a security decision, not just a configuration step.