Here's a fact that should bother you more than it does: your home has one public IP address, but twenty devices happily use the internet at once. If addresses are how replies find their way back, how does a reply meant for your laptop not end up on your TV? The answer is NAT — Network Address Translation — running on your router, translating constantly, and you've probably never noticed it exists.
The receptionist model
Think of your router as a company receptionist. Internally, every employee has a desk extension (private addresses — the 192.168.x.x family). Externally, the company has one phone number (your single public IP). When your laptop contacts a website, the router rewrites the packet — swapping the private return address for the public one — and, critically, keeps a note in a translation table: "the conversation with that website on this port belongs to the laptop." When the reply arrives at the shared public address, the receptionist checks the notes and forwards it to the right desk. Multiply by thousands of simultaneous conversations, all tracked in that table, all invisible.
The catch: nobody can call in
NAT's side effect is the important part. The receptionist can forward replies to conversations employees started — but if a stranger rings the main number asking for "the laptop," there's no note, so the call is dropped. Unsolicited inbound connections simply die at the router. This accidentally made NAT a security layer: your devices are unreachable from the internet by default, not because anyone configured a firewall, but because there's no route in.
This is also why hosting anything at home — a game server, a camera feed — needs port forwarding: a permanent note pinned to the receptionist's desk saying "anything arriving on port 25565 always goes to this machine." You're manually creating the table entry that NAT couldn't create itself.
Why NAT exists at all
NAT wasn't designed as security — it was a rescue. IPv4 has ~4.3 billion addresses; humanity has tens of billions of devices. NAT let entire households and companies hide behind single addresses, stretching a supply that should have collapsed decades ago. IPv6 removes the shortage entirely (every device can be publicly addressable), which sparks a genuinely interesting engineering debate you'll eventually meet: without NAT, the "nobody can call in" protection has to come from actual firewalls instead of a happy accident. The lesson generalises: in networking, some of the most load-bearing "security" is a side effect — and it's worth knowing which kind you're relying on.