Introducing To Networking Network Address Translation

Network Address Translation Every single host on a network (including the internet) needs to have a unique IP address. We’ve discussed how we’re running out of addresses, and one solution is to switch over to IPv6, but it hasn’t happened yet since it would take a major infrastructure change So we need a way to consolidate IP address - Network Address Translation (NAT) allows us to do this, and allows us a small measure of security as well Basically it’s a way to translate one (or more) public IP addresses into one (or more) private IP addresses

Private Addresses There are three different ranges of addresses set aside for a private network Class-A: 10.0.0.0 through 10.255.255.255 Class-B: 172.16.0.0 through 172.31.255.255 Class-C: 192.168.0.0 through 192.168.255.255 These addresses can be repeated across multiple networks, but have to be unique in a single network They are not routable by default, and are not assigned by the IANA (internet assigned number authority)

How NAT Works We would typically set up NAT on a default gateway router - a router that separates a private and public network We need to give the interface on the private side a private IP address to match our network, but the public interface will need a globally unique, routable address. The hosts on the private network can just use private addresses for local communications. They (typically) don’t need a public address If an internal host wants to communicate outside our private network, what we can do is use the router’s public address for all external communication, and then send it back to the host from the router

Many-to-One NAT There are a few different ways to implement NAT. The first is many-to-one NAT, also called dynamic NAT In this implementation we use one public IP address (the router’s) and map it to multiple private IP addresses The way we can do this is by using ports Ports are a logical construct that lets us identify what protocol, process or application a message is going to be used for, but the router will use it to identify hosts The table will temporarily map a particular port to a private IP address for each request, this way it can send back the response

Dynamic NAT Dynamic NAT automatically maps internal IP addresses with a dynamic port assignment. On the NAT device, the internal device is identified by the public IP address and the dynamic port number Although it is called many-to-one, you can also have a small pool of public addresses to map to Dynamic NAT allows internal (private) hosts to contact external (public) hosts, but not vice versa—external hosts cannot initiate communications with internal hosts

One-to-One NAT We can allow incoming communications by setting up a one-to-one, or static NAT A static NAT assigns a specific IP address and port to a specific host. Once we do that, outside devices on the public network can establish communications by connecting to that IP address and port External hosts contact the internal server using the public IP address and the static port We’d typically do this for something like a web server

Port Forwarding One commonly used implementation of static NAT is called port forwarding. Port forwarding allows incoming traffic addressed to a specific port to move through the firewall and be transparently forwarded to a specific host on the private network Inbound requests are addressed to the port used by the internal service on the router's public IP address (such as port 80 for a web server). This is often called the public port Port forwarding associates the inbound port number with the IP address and port of a host on the private network. This port is often called the private port Based on the public port number, incoming traffic is redirected to the private IP address and port of the destination host on the internal network

Other NAT Facts Technically, NAT only translates from one address to another. The process of mapping private IP addresses to ports is called Port Address Translation (PAT), but in modern networking equivalent they get lumped together The Internet Assigned Numbers Authority (IANA) has assigned the port range 49,152 to 65,535 to be used as dynamic ports for dynamic NAT Many to one NAT is also called IP Masquerade or Network Address and Port Translation Static NAT may also be referred to as source NAT, stateful NAT, and secure NAT