Network Address Translation

Transcription

1 Claudio Cicconetti International Master on Communication Networks Engineering 2006/2007

2 Network Address Translation (NAT) basically provides a mapping between internal (i.e., private) IP addresses and officially assigned (i.e., public) external addresses. NAT was suggested as a short-term solution to the problem of IP address depletion. The idea of NAT is based on the fact that only a small number of the hosts in a private network are communicating outside of that network. If each host is assigned an IP address from the official IP address pool only when they need to communicate, then only a small number of official addresses are required.

3 Consider as example an internal network that is based on the private IP address space, and the users want to use an application protocol for which there is no application gateway. The only option is to establish IP-level connectivity between hosts in the internal network and hosts on the Internet. However, IP datagrams with private IP address in the source field cannot be sent through the Internet.

4

5 The NAT mechanism takes the IP address of an outgoing packet and dynamically translates it to an officially assigned global address. For incoming packets it translates the assigned address to the internal address. From the point of two hosts that exchange IP packets with each other, one in the secure network and one in the non-secure network, NAT looks like a standard IP router that forwards IP packets between two network interfaces.

6 For each outgoing IP packet, the source address is checked by the NAT configuration rules. If a rule matches the source address, the address is translated to a global address from the address pool. The predefined address pool contains the addresses that NAT can use for translation. For each incoming packet, the destination address is checked if it is used by NAT.

7

8 NAT keeps track of which internal IP addresses are mapped to which external IP addresses at any given point in time, so it will be able to map a response it receives from the external network into the corresponding secure IP address. If NAT translates an address for an IP packet, the checksum is also adjusted.

9 Three traditional types of NAT: Full cone NAT: an external host can always send IP datagrams to the internal host Restricted cone NAT: an external host can only send IP datagrams to the internal host if the latter previously sent an IP datagram to it Port restricted cone NAT: same as above, but the restriction applies on a port-by-port basis

10

11

12

13 Some examples of NAT configuration under linux >= 2.4. To show the current NAT table: iptables -t nat -L To modify the source IP address of all IP datagrams from into : iptables -t nat -A POSTROUTING -s \ -j SNAT --to-source To modify the destination IP address of all IP datagrams to into : iptables -t nat -A PREROUTING -d \ -j SNAT --to-destination

14 Port Address Translation It is also possible for a NAT server to use the same public IP address for many private hosts. In this case, the NAT server is required to keep track of the higher layer protocol status. This is usually called Port Address Translation (PAT). For example, since TCP is connection-oriented, the NAT server can keep track of established TCP connections and demultiplex incoming IP datagrams accordingly.

15 Port Address Translation

16 Port Address Translation This approach does not work with all applications. For instance, FTP exchanges IP address information in the application data part of an IP packet, and NAT will generally not be able to handle translation of IP addresses in the application protocol. Thus, additional complexity is needed in the NAT server to handle FTP applications.