In practice, due to limited IPv4 addresses, private IP addresses are usually used in LANs.
l Class A: 10.0.0.0 - 10.255.255.255
l Class B: 172.16.0.0 - 172.31.255.255
l Class C: 192.168.0.0 -192.168.255.255
A private network is not allowed to connect to the Internet because it uses a private IP address. Driven by requirements, many private networks also need to connect to the Internet to implement communication between private networks and the Internet and between private networks through the Internet. The interconnection between the private network and the Internet must be implemented using the NAT technology.
Network address translation (NAT) translates the IP address in an IP datagram header to another IP address, allowing users on private networks to access public networks.
Static NAT
Static NAT: A private IP address is mapped to a fixed public IP address.
Feather:
1. Bidirectional access: When an internal host with a private IP address accesses the Internet, the egress NAT device translates the private IP address into a public IP address. Similarly, when an external network device sends packets to access an internal network, the NAT device translates the public address (destination address) carried in the packets into a private address.
2. Static NAT strictly maps addresses in one-to-one mode. As a result, even if an internal host is offline for a long time or does not send data, the public address is still occupied by the host.
Dynamic NAT(NO-PAT)
Dynamic NAT: A private IP address is mapped to a public IP address from a NAT address pool containing a group of public IP addresses.
When an internal host accesses an external network, an available IP address in a NAT pool is temporarily assigned to the host and marked as In Use. When the host no longer accesses the external network, the assigned IP address is reclaimed and marked as Not Use.
As shown in the following figure, the dynamic NAT process is as follows:
1. The Router receives a request packet sent from the host on the private network for accessing the server on the public network. The source IP address of the packet is 192.168.1.1.
2. The Router selects an idle public IP address (122.1.22.2) from the IP address pool, and sets up forward and reverse NAT entries that specify the mapping between the source IP address of the packet and the public IP address. The Router translates the packet's source IP address to the public IP address based on the forward NAT entry, and sends the packet to the server on the public network. After the translation, the packet's source IP address is 122.1.22.2, and its destination IP address is 200.1.2.3.
3. After receiving a response packet from the server on the public network, the Router queries the reverse NAT entry based on the packet's destination IP address. The Router translates the packet's destination IP address to the private IP address of the host on the private network based on the reverse NAT entry and sends the packet to the host. After the translation, the packet's source IP address is 200.1.2.3, and its destination IP address is 192.168.1.1.
NATP
In addition to one-to-one address translation, Network Address and Port Translation ( NAPT) allows multiple private IP addresses to be mapped to the same public IP address. It is also called many-to-one address translation or address reuse.
NAPT translates the IP address and port number of a packet so that multiple users on a private network can use the same public IP address to access the public network.
The NAPT process is as follows:
1. The Router receives a request packet sent from the host on the private network for accessing the server on the public network. For example, the packet is sent from Host A to Router, its source IP address is 192.168.1.1, and its port number is 10321.
2. The Router selects an idle public IP address and an idle port number from the IP address pool, and sets up forward and reverse NAPT entries that specify the mapping between the source IP address and port number of the packet and the public IP address and port number. The Router translates the packet's source IP address and port number to the public IP address and port number based on the forward NAPT entry, and sends the packet to the server on the public network. For example, after the translation is performed on the packet of Host A, the packet's source IP address is 122.1.2.2, and its port number is 1025.
3. After receiving a response packet from the server on the public network, the Router queries the reverse NAPT entry based on the packet's destination IP address and port number. The Router translates the packet's destination IP address and port number to the private IP address and port number of the host on the private network based on the reverse NAPT entry, and sends the packet to the host. For example, after the translation is performed on the packet sent from the server to Host A, the packet's destination IP address is 192.168.1.1, and its destination port number is 10321.
Easy IP
Easy IP: translates both IP addresses and transport-layer port numbers. The implementation of Easy IP is the same as that of NAPT. The difference is that Easy IP does not involve address pools. It uses an interface address as apublic address for NAT.
Easy IP applies to scenarios where public IP addresses are not fixed, such as scenarios where public IP addresses are dynamically obtained by egress devices on private networks through DHCP or PPPoE dialup.
NAT Server
For security purposes, most private network hosts do not expect access from public network users. However, in some applications, public network users need to access a private network server, for example, a WWW server or a private network FTP server . In dynamic nat or NAPT, NAT entries cannot be dynamically created for the access initiated by public network users. As a result, public network users cannot access private network hosts.
To address this problem, the NAT Server function (also called NAT internal server) can be configured. This function creates mappings between private IP addresses+port numbers and public IP addresses+port numbers on a NAT device. With this function, the NAT device can reversely translate public IP addresses to private IP addresses so that users on a public network can access the internal servers.
For example, as shown in the following figure, the NAT server function is enabled on a NAT device, and a private network server's IP address+port number (192.168.1.10:80) is mapped to a public network IP address+port number (122.1.1.1:80). When a public network host requires to access the server 192.168.1.10, the NAT device converts 122.1.1.1:80 to 192.168.1.10:80, so that the service request can reach the server 192.168.1.10 on the private network.
