A firewall, like a router, can deploy the NAT function to perform address translation. But compared to routers, the NAT function of the firewall provides richer options, allowing administrators to use the NAT function more flexibly. In this article, we will discuss the firewall in the source NAT function.
The source NAT of the firewall can be divided into two types: address translation only and address and port translation simultaneously. The address-translation-only mode includes NAT No-PAT, while the address-and-port-translation mode includes NAPT, Smart NAT, easy IP, and triple NAT.
NAT No-PAT
NAT No-PAT only performs simple source address translation. When the administrator configures NAT No-PAT, a NAT address pool needs to be specified. When the device performs source address translation of user messages, it will select an IP address from the address pool, replace the source IP address in the message, and create a server-map entry and session entry, and then send the message.
Since each user will need a public network address to perform source address replacement, if there are 100 internal network users, 100 public network addresses are needed to meet the simultaneous source address translation requests. Therefore, NAT No-PAT will not save public network addresses resource.
Figure 1: NAT No-PAT translate per source IP to a unique public IP address
NAPT
Compared with NAT No-PAT, NAPT will not only translate the source IP address, but also the source port. Because of this mechanism, NAPT allows one public IP address to correspond to multiple private network users, and the firewall distinguishes different users based on port numbers. In addition, NAPT does not generate a server-map table and a session entry for each conversion at the same time as NAT No-PAT does. Instead, it only generates a session entry for each conversion.
Figure 2: NAPT translates both the IP and port
Smart NAT
The emergence of Smart NAT is to solve the contradiction that NAT No-PAT can only provide a few address translation needs to the intranet users. Smart NAT combines two modes of NAT No-PAT and NAPT. It specifies an IP address in the address pool as a reserved IP. When the remaining addresses in the address pool are exhausted by NAT No-PAT, if there are additional users who need address translation services, NAPT translation will be performed by the firewall for these users' address translation requirements.
Easy IP
Easy IP mode is very similar to NAPT mode, both of which convert the source IP address and source port at the same time. However, NAPT will encounter scenarios where the user’s public IP is not a fixed IP, such as a PPPoE dial-up user. At this time, there is no way to specify a NAT address pool on the device, and the easy IP mode can be used.
The Easy IP mode replaces the source IP address of the message with the IP address of the export interface, eliminating the need for the process of specifying a NAT address pool. This makes it possible for address translation in PPPoE scenarios.
Triple NAT
Triple NAT is also a mode that translates addresses and ports at the same time. But the biggest difference from other source NAT methods is that triple NAT allows public network users to access private network users. This is because the other source NAT modes are performed in the 5-tuple NAT mode, and there may be different private network users sharing the same port number of the same public IP, such as:
Assuming that the NAT address is 1.1.1.1,
When the source address 10.1.1.1 accesses the TCP 80 port of 2.2.2.2, the port 1000 of 1.1.1.1 is used to mark the conversation. At this time, when 10.1.1.2 accesses the TCP 200 port of 2.2.2.2, the port 1000 of 1.1.1.1 can still be used to mark the new conversation. However, when 10.1.1.2 also accesses the TCP 80 port of 2.2.2.2, it is necessary to mark the session with other ports of 1.1.1.1.
Figure 3: Port reuse in the 5-tuple NAT
In other words, when the firewall marks the session with a five-tuple (source port, destination port, source address, destination address, protocol number), even if the source address and source port after the replacing are duplicated, as long as the destination port or destination IP address is not the same, the firewall can distinguish these two sessions。
Unlike five-tuple NAT, the three-tuple NAT mode does not reuse port numbers, so it can uniquely identify a user, and make it possible to access private network users from the public network.
Like NAT No-PAT, triple NAT also generates server-map entry and session entry at the same time。
Summarize
Table 1 shows the similarities and differences of these five source NAT modes in detail.
NAT No-PAT | NAPT | Smart NAT | Easy IP | Triple NAT | |
Translation source IP | Y | Y | Y | Y | Y |
Conversion source port | N | Y | Y | Y | Y |
Generate server-map entry | Y | N | N | N | Y |
Generate session entry | Y | Y | Y | Y | Y |
Allow public network users to actively access | Y | N | N | N | Y |
Need NAT address pool | Y | Y | Y | N | Y |
For the destination NAT part, you can visit Destination NAT types of firewall.
You have gained a firecracker
