Exercise 2: Why an Unsolicited Inbound Connection Can't Reach a Laptop Behind a Router — Possible Solution ==================================================================== Explanation: Per the chapter, "NAT only tracks mappings for connections initiated from the inside." This is the direct mechanism at work here, entirely independent of any firewall. When the laptop itself initiates an outgoing connection, the router creates a specific, temporary mapping between that laptop's private IP/port and the public IP/port combo it rewrote the outgoing packet to use -- this mapping is what lets the router correctly route the RESPONSE back to the right internal device once it arrives. An unsolicited inbound connection from the internet is a fundamentally different situation: it arrives at the router's public IP address on some port, but there is no pre-existing mapping in the router's own NAT table for it, because nothing inside the network ever initiated a matching outgoing connection to create one. Per the chapter's own explanation of the outgoing/incoming translation process, the router's whole mechanism for knowing WHICH internal device an incoming packet belongs to depends entirely on that mapping having already been created by an earlier outgoing request. With no mapping to consult, the router has no way to know which internal private IP address the unsolicited packet is even meant for -- it isn't that the router is actively blocking or inspecting the packet as a security decision (that would be a firewall's job); it's that NAT's own translation mechanism simply has no destination to translate the packet to, and the connection attempt goes nowhere. This is why the chapter specifically notes port forwarding as the "extra configuration" needed to let an inbound connection through -- port forwarding is exactly the act of manually creating a permanent mapping in the router's NAT table ahead of time, in place of the mapping that would normally only get created by an outgoing request. WHY THIS WORKS AS AN ANSWER ------------------------------ This explains the actual mechanism (NAT mappings only get created by outgoing connections, so an inbound connection with no matching mapping has nowhere to be routed) rather than attributing the blocking to a firewall, matching the exercise's own explicit "without any firewall being involved at all" framing.