CS 520: Network Architecture I Winter Lecture 11: NAT and IPv6

Transcription

1 CS 520: Network Architecture I Winter 2007 Lecture 11: NAT and IPv6 The previous lecture discussed how subnetting and supernetting (CIDR) can be used to make better use of global IP addresses. This lecture provides discussion of a stopgap approach that is commonly used (NAT), and a solution that will end the addressing problem for good (IPv6). Chapter 20 - Private Network Interconnection (VPN, NAT) I. Network Address Translation (Section 20.6 and RFC 3022) Private networks can use their own addressing schemes Do not need globally unique addresses inside the network. Do not need to use up IPv4 addresses inside the network. To interact outside the network, a private network could use a small set of addresses. Which must be globally unique. And can use as many addresses as they wish inside a private network. Can use all 32 bits. But normally use the CIDR private address ranges. Can avoid any address renumbering inside a network. Hosts inside the network only need a globally unique address when they wish to communicate outside the network. Assumption: Only a few globally unique addresses are needed at any one time. Can be shared and reallocated as needed. But addresses do not even really need to be allocated. Lecture 11, Page 1 of 9

2 All that is really needed is a translation function. Each host uses a private address inside the network. Formally called Network Address Translation (NAT) All datagrams pass through a device informally called a to go to the global Internet. The NAT box changes the address to be appropriate for the global Internet. The SOURCE ADDRESS in the IP datagram is now assigned by the NAT box. - A globally unique address. - A NAT box could have a set of addresses it could use. - The host sets the address, but the NAT box changes the address. Normally a source address does not change. To the rest of the world, it looks like all packets come from the NAT box. For outgoing datagrams: Replace the source address with a globally unique address. Easy. For incoming datagrams Replace the NAT box address with the internal private address. Not so easy. How does NAT know which internal address applies to a datagram it receives from the Internet? In general, a NAT box must have a translation table. Translate from information in a received datagram to an internal private address. If there is no entry in the translation table for a datagram, the datagram cannot be delivered. Can use a manually configured table. With static translations that are always used. If no entry in the table, some hosts will not be able to send outgoing datagrams or receive incoming datagrams. More than one end host would be mapped to the same external IP address. - Otherwise the benefit of NAT is completely lost. Lecture 11, Page 2 of 9

3 But what must the NAT box do to prevent a problem with this approach? The NAT box must make sure that more than one end host is not using the same external address at the same time. - Some end hosts would need to be blocked from communicating if that were the case. Another approach is to fill the table based on outgoing datagrams. Any host can send an outgoing datagram. The NAT box will assign an address and remember the address it uses. With this approach, communication cannot be initiated from a host the network. - Why? It would not know which address to use. Another approach would be to fill the table based on other information. Like web addresses. Most implementations use outgoing datagrams to initialize the table. Lecture 11, Page 3 of 9

4 Port-mapped NAT Upper layer protocols use the concept of ports in addition to the IP address. Like with UDP and TCP (discussed in a later lecture). IP only specifies the destination host for a datagram. - But a host may be executing multiple processes simultaneously. The real destination of a datagram is to one of those processes. But it is difficult to send a datagram to a process. - Processes are created and destroyed dynamically. - We would like to replace processes and still receive datagrams. - We need to identify destinations by the functions they implement without needing to know the specific process. Therefore, each machine contains a set of abstract destination points called protocol ports. - Identified by a positive integer. - The local operating system provides an interface mechanism to those ports. In general, ports are buffered. - Packets for a particular port are buffered. - A process extracts packets when it is ready. So, to conduct communication between applications, the sending application needs to know both the IP address and the port number. NAT can use TCP or UDP port numbers as well as addresses. Sometimes called Network Address Port Translation (NAPT). Can have 16 bits worth of port numbers. Simple example. A network could have one globally unique IP address. Say: And each host application could have a port. - Say is using port for a particular application. ( / 21023) Then NAT chooses to send this packet out onto the global Internet with source address and source port as ( / 14003) Packets that arrive to for port would be sent to / A unique port number would have to be assigned for each communication on the external Internet (in this case it was 14003). So, a NAT box will assign an IP address and a port number to outgoing packets. Lecture 11, Page 4 of 9

5 Advantages of port-mapped NAT. Can conceptually use only a single global IP address. - Without port-mapped NAT, the number of computers that could be accessing the Internet is limited to the number of addresses that can be used by the NAT box. - With port-mapped NAT, there is no practical limit (16 bits for port numbers). Disadvantage Depends on TCP and UDP. Complications in implementing NAT Error messages must be handled properly. NAT will not work with applications that send IP addresses or protocol ports as data. Maybe if it is a standard application, like the File Transfer Protocol (FTP), a special translator can be created. But then the packets could not be encrypted by the end host. - Since NAT would need to be able to read the packet and change it. - So a security weakness exists that does not allow end-to-end encryption. - Or the NAT box must temporarily undo the encryption to change the address, which makes the NAT box a vulnerable point. NAT also compromises the robustness, security, performance, and manageability of the Internet. More difficult to coordinate control and error messages with hosts behind a NAT box. Since NAT usually uses outgoing datagrams to initialize the table, some applications cannot be executed that are initiated from the outside. Unless allowed on an exceptional basis using manually configured permanent address maps for pre-selected hosts/host ports. Lecture 11, Page 5 of 9

6 What are examples of applications where unsolicited incoming datagrams are common and where NAT will not work without special functionality? IP Telephony, peer-to-peer games, home servers, file sharing. - This special functionality may involve devices behind the NAT box to subscribe to a directory before they can receive outside requests. So, how does one summarize the effectiveness of NAT at slowing down the exhaustion of IPv4 addresses? Can use one address for many hosts. Very good so far. But less effective for peer-to-peer applications. Chapter 31 - The Future of TCP/IP (IPv6) Also: From a very good overview of IPv6 by Steve Deering of Cisco, coauthor of the RFC and co-chair of WG. He gave this presentation at UMKC. c2_ipv6.pdf II. The Future of TCP/IP IPv4 has operated well since the late 1970's. Lecture 11, Page 6 of 9

7 But the 32 bit address space is being exhausted. Comer predicts all addresses will be gone by Even with CIDR. Even with NAT. Even with some organizations, like Stanford, reallocating their addresses and giving back unused addresses. (See: where Stanford gave back its Class A address). Even with 4 billion possible addresses, only about 250 million are usable (see RFC 3194). Today there are 100~150 million devices. Address allocations must still be very conservative. Most existing address allocations will not likely be given back. - See for the list of how the address space is currently allocated. - Especially look at the /8 addresses for specific organizations. (General Electric, IBM, AT&T Bell Laboratories, Xerox, Ford, MIT, and MERIT) - MERIT is an educational network in Michigan analogous to MOREnet in Missouri million addresses for these organizations!? Steve Deering says the ONLY compelling reason for IPv6 is more addresses! Billions of new users in Japan, China, India, etc. Billions of new IP-enabled devices mobile phones, cars, appliances, etc. Always-on access for home devices through DSL, cable modems, etc. To phase out NAT, because of its limitations that were discussed above. Business demands the only demands that really mean anything Demand for cellular wireless services around the world. Demand for Internet gaming (peer-to-peer). Microsoft includes IPv6 in Windows XP (by default it is not enabled). Lecture 11, Page 7 of 9

8 If IP is to be replaced, we can implement new features as well. IPv6 Processing power is much different in routers than in the 1970 s. New types of capabilities: Support for real-time applications. Network resource reservations. Electronic commerce. Built-in security. Started under the IPng effort (Next Generation IP). Version 5 was taken by an experimental protocol. Due to a misunderstanding. Designers call IPv6 basically the same as IPv4 with a few modifications. Not a radical change. No changes to IPv4 QoS and routing. Features Larger addresses bits - From 2 32 (4 x 10 9 ) to (256 x ) possible hosts. - addresses for each square meter of the Earth's surface. - Address representation can be done several ways. Additional levels of addressing hierarchy are possible (multiple levels of subnetting). Flexible header formats. - Entirely new datagram format. Improved options fields. Ability to extend the protocol in the future. Support for autoconfiguration and renumbering. Support for QoS resource allocations. Lecture 11, Page 8 of 9

9 The protocol spec puts more functions into options fields. IPv6 calls these options extension headers. For example, fragmentation information would be put in an extension header. - By default, fragmentation is not allowed, unless the extension header is used. - Can either use a guaranteed minimum MTU of 1280 octets or use MTU probing. - The source will make sure datagrams are the correct size before they are sent out. No header checksum Expensive to compute - 50% of the instructions in current IPv4 routers that are executed are for checksums. Assumes TCP/UDP and Layer 2 devices check for errors. The header length field eliminated. The transition to IPv6 is a big issue. IPv6 has been slow to catch on. Requires a costly and time-consuming upgrade to the Internet's backbone and edge systems. Can operate IPv4 and IPv6 at the same time. Can send IPv6 packets in IPv4 packets through IPv4-only areas. Can translate IPv6 packets to IPv4 packets. Demand for IPv6 gear is small. Vendors are starting to supply more products, however. But vendor products in many cases are missing pieces for a full IPv6 implementation. IPv4 and supporting technologies already can do a lot of what IPv6 does, but without larger addresses. Status of IPv6 The U.S. government wants civilian and defense agencies to adapt their networks by mid-2008 to support IPv6-based traffic. The transition to an IPv6-based world has not yet gathered steam. Stay tuned for another day: IPv6 is still for tomorrow. Daniel Minoli, Network World, 03/06/07. Next lecture: Internet control messages. Lecture 11, Page 9 of 9