Network Address

Translation (NAT)

Scott Rixner
Review: Private IPv4 Addressing

Not routable on public internet
 No chance of conflict with a valid public IP

Why do I want private addresses?
 Not every printer / fax machine / IPod / etc. needs to
be publicly accessible from the Internet
 Useful for local collections of computers not
connected to internet
Name IP address range Number of IPs
24-bit block 10.0.0.0 – 10.255.255.255 16,777,216
20-bit block 172.16.0.0 – 172.31.255.255 1,048,576
16-bit block 192.168.0.0 – 192.168.255.255 65,536

Network Systems Architecture 2

Preview: TCP and UDP

Two common protocols nested inside IP packets

TCP UDP

Reliability guaranteed
Delivery not guaranteed

Connection-based
No connections
 Stream of data between  Each packet is
two endpoints independent (like IP)
 Must explicitly open
and close

Each protocol uses port numbers to distinguish

between independent data streams

Network Systems Architecture 3

Network Address Translation

Translate / route packets between one IP
address space and another
 Commonly translates from private IP range to
public IP range (but the concept can be
generalized to two public address ranges)

Accomplished by modifying packet header
 Source address
 Destination address Not every NAT technique
modifies every field!
 IP port number
 IP / TCP / UDP checksums

Network Systems Architecture 4

Network Address Translation
CRET
SE
TOP
Network A Network B
Internal External
NAT

Network A
Network B
 Multiple computers trying to  Traffic from network A
access network B appears with addresses in
 Don’t want to reveal Network B’s space
network A’s structure to  May be mapped as single
network B or multiple addresses

Network Systems Architecture 5

Is a NAT Device a Router?

Internal and External networks are completely separate
 MAC addresses are not propagated across NAT unit – just like a
router!

IP packets must be routed to NAT to reach external
network
 The NAT unit is often the final router on the internal network

Most actual NAT devices contains a built-in 2-port router
with a minimal set of routing capabilities
 Table lookups
 Modify packet headers
 Recalculate checksums

Network Systems Architecture 6

Why Use Address Translation?

Allows multiple hosts on private network to access public
network through a single address
 Overcomes policy problems (e.g. buying extra IPs from your ISP
costs $$)
 Overcomes IPv4 address shortages in developing world

Disguises internal network structure
 All requests appear to originate from NAT unit
 Increases “security”

Allows you to use entire 10.x.x.x private address space
and remap to smaller public address range
 Very convenient for clean network topology and simplified router
forwarding tables

Network Systems Architecture 7

Types of Translation

Terms are used interchangeably

Network Address Translation (NAT)
 Translatesonly the address fields, not ports
 Every machine on network A gets a unique
address on network B

Port Address Translation (PAT)
 Translates address and port numbers
 Allows multiple machines on network A to
share single IP address on network B

All requests appear to come from PAT unit

Network Systems Architecture 8

Network Address Translation Types

One-to-One Mapping Internal External

 Every internal IP gets a 192.168.32.10 213.18.15.110

PC 1

Public Network
different external IP 213.18.15.111
192.168.32.12
PC 2 NAT
213.18.15.112

Static PC 3
192.168.32.15

 Internal IP is always
mapped to same NAT Mapping Table: Static or Dynamic
External IP Internal IP External IP
192.168.32.10 213.18.15.116

Dynamic / Pooled 192.168.32.12 213.18.15.112

 Internal IP is mapped to 192.168.32.15 213.18.15.125

… …
random external IP
Not shown in Table: MAC Addresses!

Network Systems Architecture 9

 NAT Mechanics – Outbound Packet
Internal External

Internet
128.42.218.97
192.168.32.10 213.18.15.116
Packet PC 1 NAT PC 2
A B C X Y Z
… …

… …

Ethernet Header IP Header Data

Dst MAC Src MAC … … IP Csum Src IP Dst IP … Payload CRC

Before NAT (internal network)

B A … … IP Csum PC 1 PC 2 … Payload CRC
After NAT (external network)
X C … … IP Csum NAT PC 2 … Payload CRC

Save internal IP and MAC to mapping table
Recalculate checksums (Ethernet CRC, IP

Replace source IP and MAC with NAT unit header, TCP/UDP/… headers)

Network Systems Architecture 10

 NAT Mechanics – Inbound Packet
Internal External

Internet
128.42.218.97
192.168.32.10 213.18.15.116
PC 1 NAT PC 2 Packet
A B C X Y Z
… …

… …

Ethernet Header IP Header Data

Dst MAC Src MAC … … IP Csum Src IP Dst IP … Payload CRC

Before NAT (external network)

C X … … IP Csum PC 2 NAT … Payload CRC
After NAT (internal network)
A B … … IP Csum PC 2 PC1 … Payload CRC

Lookup Dst IP in mapping table. Only
Replace Dst IP and MAC with private
forward if match found address

Update checksums (CRC, IP, TCP/UDP/…)

Network Systems Architecture 11

NAT Mechanics – Inbound Packet
Internal External

Internet
128.42.218.97
192.168.32.10 213.18.15.116
PC 1 NAT PC 2 Packet
A B C Z
… …

… …

What happens if a router sends a packet

to the NAT unit, but no valid mapping
exists for the destination IP?
 Packet is dropped

Network Systems Architecture 12

Port Address Translation

IP Overloading Internal External
192.168.32.10 213.18.15.116
 Many internal IPs are Port 1701 Port 1501
PC 1

Public Network
mapped to one (or a 192.168.32.12 213.18.15.116
Port 1831 Port 1502
few) external IPs PC 2 NAT
192.168.32.15 213.18.15.116
 TCP/UDP port number PC 3
Port 1200 Port 1503

is also changed and

used to identify unique NAT Mapping Table
connections between Internal IP Internal External IP External
internal and external Port Port
192.168.32.10 1701 213.18.15.116 1501
hosts 192.168.32.12 1831 213.18.15.116 1502

 Usually dynamic 192.168.32.15 1200 213.18.15.116 1503

… … … …

Not shown in Table: MAC Addresses!

Network Systems Architecture 13

Clearing Mappings

When should a mapping be removed from a
NAT?
 Static
NAT - Never?
 Dynamic NAT - Only if the host is idle for a long time?

When should a mapping be removed from a

PAT?
 TCP –Close of connection or reasonable timeout

Connection is framed by SYN and FIN packets
 UDP – Unable to determine close of “connection”, so
must use reasonable timeout instead

Network Systems Architecture 14

Home Broadband “Router”

What is this device?

Port Address Translation
(PAT), plus a…
 4-port switch
 Router
 DHCP server External Network

 Wireless access point?

Router + PAT
 Stateful firewall?
 Blinking LEDs? 5-port Ethernet Switch

Internal Network
Network Systems Architecture 15
NAT/PAT – Protocol Problems

PAT Fails: Protocols that require incoming connections
 Example: FTP Active Mode

Client sends request

Server attempts to open new connection back to client to send data

No entry in PAT table so connection is rejected
 Example: SIP / RTP (VOIP telecommunication)

NAT / PAT Fails: Protocols that carry IP address / port values in

their payload
 Example: IPsec (and other tunneling / VPN protocols)

NAT changes src/dst addresses in header but is unable to fix encrypted
payload. Packet fails security check and is discarded because receiver
detects (correctly) that the packet was altered in transit

NAT / PAT Fails: Protocols that use checksums which include IP

addresses
 NAT only knows how to recalculate checksums for IP/TCP/UDP
packets, not any new protocol that might be developed

Network Systems Architecture 16

Application-Level Gateway (ALG)

Technique to avoid breaking common protocols

NAT device runs multiple ALGs
 Each ALG looks for a different protocol
 Rewrites packet payload to fix problems

Common ALG modules
 FTP, BitTorrent, SIP, RTSP, File transfer in IM
applications, etc…

Not future proof
 Each ALG is a fix for a specific protocol
 Need to upgrade NAT software as new applications
are developed

Network Systems Architecture 17

Severs and PAT

Is there an simple way to enable servers to
function behind a PAT?

Administrator can insert static mappings into
mapping tables
 e.g. All incoming TCP requests on port 80 should
always be forwarded to IP A.B.C.D, port 80 (enables
a web server)

Must be configured in advance

Doesn’t scale well
 What if I have two web servers behind my PAT?
 What if I don’t know the incoming port #?

Network Systems Architecture 18

Severs and NAT

Do I need to do anything to get my servers
behind NAT to work?
 No – IP address mapping is already one-to-
one
 A static mapping would be helpful for the
clients…

Network Systems Architecture 19

NAT and Security

NAT is often advertised as being essential for
security

Claim is mostly deceptive
 Security through obscurity?
 “If evil hacker on public network can’t see me, I must
be secure!”
 Computers on private network using PAT are hidden

Protects against worms scanning for exploits as long as there
are no static mappings allowing outside access

If your parents have a simple PAT in front of their unpatched
Windows box, they’re protected against some worms

Network Systems Architecture 20

NAT and Security

Provides no protection against whole classes of malware
 A security flaw in your PDF viewer can still be exploited by a bad
download
 The user can still do dangerous / stupid things
(“Click on Angelina_Jolie.exe for free pictures!”)

Limited protection on larger networks
 Servers must be publicly accessible to perform their function (via
fixed port or IP mapping)
 If your IIS webserver or Linux server with remote SSH is
unpatched, it is still vulnerable to worms
 Once compromised, this machine provides entry vector to reach
internal network, which may be completely unprotected!

Don’t let your guard down - Security in depth

Network Systems Architecture 21

Nesting IP Ranges via NAT

Allowed to have multiple levels of NAT
 Each level performs translation independently
without any understanding of entire network
(Private) (Public)
Student PC

Student PC

Student PC
68.7.230.x

10.101.23.x
Rice
(Private) (Private) NAT
My PC 1

My PC 2
192.168.20.x My
PAT 10.101.23.245

My PC 3

Network Systems Architecture 22

Future of NAT

Is NAT still needed with IPv6? IPv6 has:
 Much larger address range – No need for
NAT to save IP addresses
 No private IP address ranges

Network architects want to remove NAT
“hack” from new IPv6 networks
 ALG support can be a nightmare!

NAT can still be used with IPv6
 Nothing about NAT requires that one of the
address ranges be private
Network Systems Architecture 23
Network Systems Architecture 24