Network Address Translation

Network address translation “NAT” redirects here. For other uses, see Nat. As network address translation modifies the IP address information in packets, it has serious consequences on the quality of Internet connectivity and requires careful at- In computer networking, network address translation (NAT) provides a method[1] of modifying network ad- tention to the details of its implementation. NAT implementations vary widely in their specific behavior in vari- dress information in Internet Protocol (IP) datagram packet headers while they are in transit across a traf- ous addressing cases and in their effect on network traffic. Vendors of equipment containing implementations do not fic routing device for the purpose of remapping one [2] IP address space into another. The term NAT44 is commonly document the specifics of NAT behavior. sometimes used to more specifically indicate mapping between two IPv4 addresses; this is the typical case while IPv4 carries the majority of traffic on the Inter- 1 Basic NAT net. NAT64 refers to the mapping of an IPv4 address to an IPv6 address, or vice versa. The simplest type of NAT provides a one-to-one transla- Network administrators originally used network address tion of IP addresses. RFC 2663 refers to this type of NAT translation to map every address of one address space to a as basic NAT; it is often also called a one-to-one NAT. corresponding address in another space, such as when an In this type of NAT, only the IP addresses, IP header organization changed Internet service providers without checksum and any higher level checksums that include having a facility to announce a public route to the net- the IP address are changed. Basic NATs can be used to work. As of 2014 NAT operates most commonly in con- interconnect two IP networks that have incompatible ad- junction with IP masquerading, which is a technique dressing. that hides an entire IP address space - usually consisting of private network IP addresses (RFC 1918) - behind a single IP address in another, usually public address space. Vendors implement this mechanism in a routing device 2 One-to-many NAT that uses stateful translation tables to map the “hidden” addresses into a single IP address and that readdresses the The majority of NATs map multiple private hosts to one outgoing Internet Protocol packets on exit so they appear publicly exposed IP address. In a typical configuration, to originate from the routing device. In the reverse com- a local network uses one of the designated “private” IP munications path, the router maps responses back to the address subnets (RFC 1918). A router on that network originating IP addresses using the rules (“state”) stored has a private address in that address space. The router is in the translation tables. The translation table rules es- also connected to the Internet with a “public” address as- tablished in this fashion are flushed after a short period signed by an Internet service provider. As traffic passes unless new traffic refreshes their state. from the local network to the Internet, the source address in each packet is translated on the fly from a private ad- The method enables communication through the router dress to the public address. The router tracks basic data only when the conversation originates in the masqueraded about each active connection (particularly the destination network, since this establishes the translation tables. For address and port). When a reply returns to the router, example, a web browser in the masqueraded network can it uses the connection tracking data it stored during the browse a website outside, but a web browser outside can outbound phase to determine the private address on the not browse a web site hosted within the masqueraded net- internal network to which to forward the reply. work. However, most NAT devices today allow the network administrator to configure translation table entries All datagram packets on IP networks have a source IP for permanent use. This feature is often referred to as address and a destination IP address. Typically packets “static NAT” or port forwarding - it allows traffic origi- passing from the private network to the public network nating in the “outside” network to reach designated hosts will have their source address modified while packets in the masqueraded network. passing from the public network back to the private network will have their destination address modified. More Because of the popularity of this technique to conserve complex configurations are also possible. IPv4 address space, the term NAT has become virtually synonymous with the method of IP masquerading. To avoid ambiguity in how to translate returned packets, further modifications to the packets are required. The 1 2 3 IMPLEMENTATION vast bulk of Internet traffic is TCP and UDP packets, and ual NAT behaviors instead of using the Cone/Symmetric for these protocols the port numbers are changed so that terminology. Especially, most NAT translators combine the combination of IP address and port information on symmetric NAT for outgoing connections with static port the returned packet can be unambiguously mapped to the mapping, where incoming packets to the external address corresponding private address and port information. RFC and port are redirected to a specific internal address and 2663 uses the term network address and port translation port. Some products can redirect packets to several inter- (NAPT) for this type of NAT. Other names include port nal hosts, e.g. to divide the load between a few servers. address translation (PAT), IP masquerading, NAT over- However, this introduces problems with more sophis- load and many-to-one NAT. This is the most common ticated communications that have many interconnected type of NAT, and has become synonymous with the term packets, and thus is rarely used. NAT in common usage. This method enables communication through the router only when the conversation originates in the masqueraded network, since this establishes 2.2 Type of NAT and NAT traversal, role the translation tables. For example, a web browser in the of port preservation for TCP masqueraded network can browse a website outside, but a web browser outside could not browse a web site hosted The NAT traversal problem arises when two peers be- within the masqueraded network. However, most NAT hind distinct NAT try to communicate. One way to solve devices today allow the network administrator to config- this problem is to use port forwarding, another way is to ure translation table entries for permanent use. This fea- use various NAT traversal techniques. The most popular ture is often referred to as “static NAT” or port forward- technique for TCP NAT traversal is TCP hole punching, ing and allows traffic originating in the “outside” network which requires the NAT to follow the port preservation to reach designated hosts in the masqueraded network. design for TCP, as explained below. Protocols not based on TCP or UDP require other trans- Many NAT implementations follow the port preservation lation techniques. ICMP packets typically relate to an ex- design for TCP: for a given outgoing tcp communica- isting connection and need to be mapped using the same tion, they use the same values as internal and external IP address and port mappings as that connection. port numbers. NAT port preservation for outgoing TCP connections is crucial for TCP NAT traversal, because as TCP requires that one port can only be used for one com- 2.1 Methods of port translation munication at a time, programs bind distinct TCP sockets to ephemeral ports for each TCP communication, render- There are several ways of implementing network address ing NAT port prediction impossible for TCP.[2] and port translation. In some application protocols that use IP address information, the application running on a On the other hand, for UDP, NATs do not need to have node in the masqueraded network needs to determine the port preservation. Indeed multiple UDP communications external address of the NAT, i.e., the address that its com- (each with a distinct endpoint) can occur on the same munication peers detect, and, furthermore, often needs to source port, and applications usually reuse the same UDP examine and categorize the type of mapping in use. Usu- socket to send packets to distinct hosts. This makes port ally this is done because it is desired to set up a direct prediction straightforward, as it is the same source port communications path (either to save the cost of taking for each packet. the data via a server or to improve performance) between Furthermore, port preservation in NAT for TCP allows two clients both of which are behind separate NATs. P2P protocols to offer less complexity and less latency For this purpose, the Simple traversal of UDP over NATs because there is no need to use a third party (like STUN) (STUN) protocol was developed (RFC 3489, March to discover the NAT port since the application itself al- [2][3] 2003). It classified NAT implementation as full-cone ready knows the NAT port. NAT, (address) restricted-cone NAT, port-restricted cone However, if two internal hosts attempt to communicate NAT or symmetric NAT and proposed a methodology with the same external host using the same port number, for testing a device accordingly. However, these pro- the external port number used by the second host is cho- cedures have since been deprecated from standards sta- sen at random. Such NAT is sometimes perceived as (ad- tus, as the methods have proven faulty and inadequate to dress) restricted cone NAT and other times as symmetric correctly assess many devices. New methods have been NAT. standardized in RFC 5389 (October 2008) and the STUN Recent studies have shown that roughly 70% of clients in acronym now represents the new title of the specification: P2P networks employ some form of NAT.[4] Session Traversal Utilities for NAT.

Load more