Network address translation
|
|
In computer networking, network address translation (NAT, also known as network masquerading or IP-masquerading) is a technique in which the source and/or destination addresses of IP packets are rewritten as they pass through a router or firewall. It is most commonly used to enable multiple hosts on a private network to access the Internet using a single public IP address. According to specifications, routers should not act in this way, but it is a convenient and widely-used technique. Nonetheless, NAT can introduce complications in communication between hosts.
| Contents |
Overview
NAT first became popular as a way to deal with the IPv4 address shortage and to avoid the difficulty of reserving IP addresses. Use of NAT has proven particularly popular in countries other than the United States, which (for historical reasons) have fewer address blocks allocated per capita. It has since become a standard feature in routers for home and small-office internet connections, which typically cannot afford a larger block of IPs.
In a typical configuration, a local network uses one of the designated "private" IP address subnets (such as 192.168.x.x or 10.x.x.x), and a router on that network has a private address (such as 192.168.0.1) in that address space. The router is also connected to the Internet with a single "public" address (known as "overloaded" NAT) or multiple "public" addresses assigned by an ISP. As traffic passes from the local network to the Internet, the source address on the packets are translated on the fly from the private addresses to the public address(es). The router tracks basic data about each active connection (particularly the destination address and port). When a reply returns to the router, it uses the connection tracking data it stored during the outbound phase to determine where on the internal network to forward the reply; the TCP or UDP client port numbers are used to demultiplex the packets in the case of overloaded NAT, or IP and port when multiple public addresses are available, on packet return. To a system on the Internet, the router itself appears to be the source/destination for this traffic.
Drawbacks
Hosts behind a NAT-enabled router do not have true end-to-end connectivity and cannot participate in some Internet protocols. Services that require the initiation of TCP connections from the outside network, or stateless protocols such as those using UDP, can be disrupted. Unless the NAT router makes a specific effort to support such protocols, incoming packets cannot reach their destination. Some protocols can accommodate one instance of NAT between participating hosts ("passive mode" FTP, for example) sometimes with the assistance of an Application Layer Gateway (see below), but fail when both systems are separated from the internet by NAT. It also complicates security protocols such as IPsec.
End-to-end connectivity has been a core principle of the Internet, supported, for example, by the Internet Architecture Board. Some people thus regard NAT as a detriment to the Public Internet. Some internet service providers only provide their customers with "local" IP addresses, and they must access services external to the ISP's network through NAT, and a discussion has arisen as to whether such companies can properly be said to provide "Internet" service.
Benefits
In addition to the convenience and cost of NAT, the lack of full bidirectional connectivity can be regarded in some situations as a "feature", rather than a "limitation". To the extent that NAT depends on a machine on the local network to initiate any connection to hosts on the other side of the router, it prevents malicious activity initiated by outside hosts from reaching those local hosts. This can enhance the reliability of local systems by stopping worms, and enhance privacy by discouraging scans. Many NAT-enabled firewalls use this as the core of the protection they provide.
Basic NAT vs port number translation
Two kinds of network address translation exist. The type often popularly called simply "NAT" (also sometimes named "Network Address Port Translation" or "NAPT") refers to network address translation involving the mapping of port numbers, allowing multiple machines to share a single IP address. The other, technically simpler, form - also called NAT or "basic NAT" or "static NAT" - involves only address translation, not port mapping. This requires an external IP address for each simultaneous connection. Broadband routers often use this feature, sometimes labelled "DMZ host", to allow a designated computer to accept all external connections even when the router itself uses the only available external IP address.
NAT with port-translation comes in two sub-types: source address translation (source NAT), which re-writes the IP address of the computer which initiated the connection; and its counterpart, destination address translation (destination NAT). In practice, both are usually used together in coordination for two-way communication.
Applications affected by NAT
Some higher-layer protocols (such as FTP, Quake, and SIP) send layer-3 information inside IP datagram payloads. FTP in active mode, for example, uses separate ports for control traffic (commands) and for data traffic (file transfers). When requesting a file transfer, the host making the request also specifies the port on which it would like to receive the data. However, if the host making the request lies behind a simple NAT firewall, the mapping of the port number makes the information received by the peer invalid.
An Application Layer Gateway (ALG) can fix this problem. An ALG software module running on a NAT firewall device updates any payload data made invalid by address translation. ALGs obviously need to understand the higher-layer protocol that they need to fix, and so each protocol with this problem requires a separate ALG.
Most traditional client-server protocols (ftp being the main exception), however, do not send layer 3 contact information and therefore do not require an ALG.
Another possible solution to this problem is to use a technique like STUN. However, this requires the high level protocol be UDP-based and designed with these techniques in mind. It also does not work with symmetric NATs. Yet another possibility is UPNP but this requires the cooperation of the NAT device.
Different types of NAT
- Full cone NAT
- Restricted cone NAT
- Port restricted cone NAT
- Symmetric NAT (aka Bi-directional NAT)
Refer to external links, for further information.
Other examples of use
- Load Balancing: Destination NAT can redirect connections pointed at some server to randomly selected servers.
- Fail over: Destination NAT can be used to set up a service requiring high availability. If a system involves a critical server accessed through a router, and if the router detects that that server has gone down, it could use destination NAT to transparently re-route a connection to arrive on a backup server.
- Transparent proxying: NAT can redirect HTTP connections targeted at the Internet to a special HTTP proxy which can cache content and filter requests. Some internet service providers use this technique to reduce bandwidth usage without requiring their clients to configure their web browser for proxy support.
Related topics
- Port address translation
- Firewall (networking)
- Routing
- IPv6
- IPv4 address exhaustion
- Private IP address
- Internet Connection Sharing
- Proxy server
- Port forwarding
- STUN: Simple Traversal of UDP over NATs
External links
- NAT in Windows 2003: Setup and Configuration (http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html) - This article will describe how to setup and configure NAT in Windows 2003
- Anatomy - Volume 7, Issue 3, September 2004 (http://www.cisco.com/en/US/about/ac123/ac147/archived_issues/ipj_7-3/anatomy.html)
- HowStuffWorks: How Network Address Translation Works by Jeff Tyson (http://computer.howstuffworks.com/nat.htm/printable)
- RFC 4008 - Standards Track - Definitions of Managed Objects for Network Address Translators (NAT)
- RFC 3022 - Traditional IP Network Address Translator (Traditional NAT)
- RFC 1631 - Obsolete - The IP Network Address Translator (NAT)da:Network Address Translation
de:Network Address Translation es:NAT fr:Network address translation it:Network address translation nl:Network Address Translation ja:IPマスカレード pl:NAT fi:Osoitteenmuunnos zh:NAT