|
In computer networking, Network Address Translation (NAT, also known as Network Masquerading, Native Address Translation or IP Masquerading) is a technique of transceiving network traffic through a router that involves re-writing the source and/or destination IP addresses and usually also the TCP/UDP port numbers of IP packets as they pass through. Checksums (both IP and TCP/UDP) must also be rewritten to take account of the changes. Most systems using NAT do so in order to enable multiple hosts on a private network to access the Internet using a single public IP address (see gateway). Nonetheless, NAT can introduce complications in communication between hosts and may have a performance impact. A computer network is an interconnection of a group of computers. ...
A computer network is an interconnection of a group of computers. ...
This article is about a computer networking device. ...
An IP address (Internet Protocol address) is a unique address that certain electronic devices currently use in order to identify and communicate with each other on a computer network utilizing the Internet Protocol standard (IP)—in simpler terms, a computer address. ...
The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ...
User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...
The Internet Protocol (IP) is a data-oriented protocol used for communicating data across a packet-switched internetwork. ...
In information technology, a packet is a formatted block of data carried by a packet mode computer network. ...
It has been suggested that RFC 1918 be merged into this article or section. ...
In telecommunications, the term gateway has the following meanings: In a communications network, a network node equipped for interfacing with another network that uses different protocols. ...
Overview
NAT first became popular as a way to deal with the IPv4 address shortage and to avoid all the difficulty of reserving IP addresses. NAT has proven particularly popular in countries other than the United States, which (for historical reasons) have fewer address-blocks allocated per capita. It has become a standard feature in routers for home and small-office Internet connections, where the price of extra IP addresses would often outweigh the benefits. NAT also adds to security as it disguises the internal network's structure: all traffic appears to outside parties as if it originates from the gateway machine. IP address starvation refers to the decreasing availability of publicly available IPv4 IP addresses. ...
This article is about a computer networking device. ...
In a typical configuration, a local network uses one of the designated "private" IP address subnets (the RFC 1918 Private Network Addresses are 192.168.x.x, 172.16.x.x through 172.31.x.x, and 10.x.x.x - using CIDR notation, 192.168/16, 172.16/12, and 10/8), and a router on that network has a private address (such as 192.168.0.1) in that address space. The router is also connected to the Internet with a single "public" address (known as "overloaded" NAT) or multiple "public" addresses assigned by an ISP. As traffic passes from the local network to the Internet, the source address in each packet is translated on the fly from the private addresses to the public address(es). The router tracks basic data about each active connection (particularly the destination address and port). When a reply returns to the router, it uses the connection tracking data it stored during the outbound phase to determine where on the internal network to forward the reply; the TCP or UDP client port numbers are used to demultiplex the packets in the case of overloaded NAT, or IP address and port number when multiple public addresses are available, on packet return. To a system on the Internet, the router itself appears to be the source/destination for this traffic. It has been suggested that RFC 1918 be merged into this article or section. ...
Warning! This Article contains disinformation. ...
“ISP†redirects here. ...
The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ...
User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...
It has been suggested that this article or section be merged into Computer port (software). ...
In telecommunications, multiplexing (also muxing or MUXing) is the combining of two or more information channels onto a common transmission medium using hardware called a multiplexer or (MUX). ...
It has been argued that the wide adoption of IPv6 would make NAT unnecessary, as NAT is a method of handling the shortage of IPv4 address space. Internet Protocol version 6 (IPv6) is a network layer protocol for packet-switched internetworks. ...
Drawbacks Hosts behind NAT-enabled routers do not have true end-to-end connectivity and cannot participate in some Internet protocols. Services that require the initiation of TCP connections from the outside network, or stateless protocols such as those using UDP, can be disrupted. Unless the NAT router makes a specific effort to support such protocols, incoming packets cannot reach their destination. Some protocols can accommodate one instance of NAT between participating hosts ("passive mode" FTP, for example), sometimes with the assistance of an Application Layer Gateway (see below), but fail when both systems are separated from the Internet by NAT. Use of NAT also complicates tunneling protocols such as IPsec because NAT modifies values in the headers which interfere with the integrity checks done by IPsec and other tunneling protocols. End-to-end connectivity is a property of the Internet that allows all nodes of the network to send packets to all other nodes of the network, without requiring intermediate network elements to further interpret them. ...
The Internet Protocol (IP) is a data-oriented protocol used for communicating data across a packet-switched internetwork. ...
The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ...
User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...
This article is about the File Transfer Protocol standardised by the IETF. For other file transfer protocols, see File transfer protocol (disambiguation). ...
An Application Layer Gateway ( ALG ) is a SIP Back to Back User Agent ( B2BUA ). An ALG can be used to allow firewall traversal with SIP. If the firewall has its SIP traffic terminated on an ALG then the responsibility for permitting SIP sessions is passed onto the ALG instead...
A tunneling protocol is a network protocol which encapsulates one protocol or session inside another. ...
IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. ...
IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. ...
End-to-end connectivity has been a core principle of the Internet, supported for example by the Internet Architecture Board. Current Internet architectural documents observe that NAT is a violation of the End-to-End Principle, but that NAT does have a valid role in careful design.[1] There is considerably more concern with the use of IPv6 NAT, and many IPv6 architects believe IPv6 was intended to remove the need for NAT.[2] The Internet Architecture Board (IAB) is the committee charged with oversight of the technical and engineering development of the Internet by the Internet Society (ISOC). ...
Some Internet service providers (ISPs) only provide their customers with "local" IP addresses.[citation needed]Thus, these customers must access services external to the ISP's network through NAT. As a result, it may be argued[citation needed] that such companies do not properly provide "Internet" service. “ISP†redirects here. ...
Benefits In addition to the convenience and low cost of NAT, the lack of full bidirectional connectivity can be regarded in some situations as a feature rather than a limitation. To the extent that NAT depends on a machine on the local network to initiate any connection to hosts on the other side of the router, it prevents malicious activity initiated by outside hosts from reaching those local hosts. This can enhance the reliability of local systems by stopping worms and enhance privacy by discouraging scans. Many NAT-enabled firewalls use this as the core of the protection they provide. A computer worm is a self-replicating computer program. ...
This article is about the network security device. ...
The greatest benefit of NAT is that it is a practical solution to the impending exhaustion of IPv4 address space. Networks that previously required a Class B IP range or a block of Class C network addresses can now be connected to the Internet with as little as a single IP address (many home networks are set up this way). The more common arrangement is having machines that require true bidirectional and unfettered connectivity supplied with a 'real' IP address, while having machines that do not provide services to outside users tucked away behind NAT with only a few IP addresses used to enable Internet access. Classful networking is the name given to the first round of changes to the structure of the IP address in IPv4. ...
Basic NAT and PAT Two kinds of network address translation exist: - PAT (Port Address Translation) - The type popularly, but incorrectly, called simply "NAT" (also sometimes named "Network Address Port Translation, NAPT") refers to network address translation involving the mapping of port numbers, allowing multiple machines to share a single IP address.
- Basic NAT - The other, technically simpler, forms—"one-to-one NAT", "basic NAT", "static NAT" and "pooled NAT"—involve only address translation, not port mapping. This requires an external IP address for each simultaneous connection. Broadband routers often use this feature, sometimes labelled "DMZ host", to allow a designated computer to accept all external connections even when the router itself uses the only available external IP address.
NAT with port-translation (i.e. PAT) comes in two sub-types: source address translation (source NAT), which re-writes the IP address of the computer which initiated the connection; and its counterpart, destination address translation (destination NAT). In practice, both are usually used together in coordination for two-way communication. It has been suggested that this article or section be merged with Port forwarding. ...
Broadband in telecommunications is a term that refers to a signaling method that includes or handles a relatively wide range of frequencies, which may be divided into channels or frequency bins. ...
In computing, some home routers (SOHO/Linksys/SMC) refer to a DMZ host. ...
Relationship between NAT and PAT PAT is closely related to NAT.
In NAT, generally only the IP addresses are modified: There is a 1:1 correspondence between publicly exposed IP addresses and privately held IP addresses. In PAT, both the sender's private IP and port number are modified; the PAT device chooses the port numbers that will be seen by hosts on the public network.
In NAT, incoming packets are routed to their destination IP address on the private network by reference to the incoming source IP address given by the host on the public network. In PAT, there is generally only one publicly exposed IP address and incoming packets from the public network are routed to their destinations on the private network by reference to a table held within the PAT device that keeps track of public and private port pairs. This is often called connection tracking.
Some devices that offer NAT, such as broadband routers, actually offer PAT. For this reason, there is considerable confusion between the terms. The common use of NAT to include PAT devices suggests that PAT should be considered a type of NAT rather than a distinct technology.
NAT and TCP/UDP "Pure NAT", operating on IP alone, may or may not correctly pass protocols that are totally concerned with IP information, such as ICMP, depending on whether the payload is interpreted by a host on the "inside" or "outside" of translation. As soon as the protocol stack is climbed, even with such basic protocols such TCP and UDP, the protocols will break unless NAT takes action beyond the network layer. The Internet Control Message Protocol (ICMP) is one of the core protocols of the Internet protocol suite. ...
The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. ...
User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...
IP has a checksum in each packet header, which provides error detection only for the header. IP datagrams may become fragmented and it is necessary for a NAT to reassemble these fragments to allow correct recalculation of higher level checksums and correct tracking of which packets belong to which connection.
The major transport layer protocols, TCP and UDP, have a checksum that covers all the data they carry, as well as the TCP/UDP header, plus a "pseudo-header" that contains the source and destination IP addresses of the packet carrying the TCP/UDP header. For an originating NAT to successfully pass TCP or UDP, it must recompute the TCP/UDP header checksum based on the translated IP addresses, not the original ones, and put that checksum into the TCP/UDP header of the first packet of the fragmented set of packets. The receiving NAT must recompute the IP checksum on every packet it passes to the destination host, and also recognize and recompute the TCP/UDP header using the retranslated addresses and pseudo-header. This is not a completely solved problem. One solution is for the receiving NAT to reassemble the entire segment and then recompute a checksum calculated across all packets.
It may be wise for the originating host to do MTU Path Discovery (RFC1191) to determine what MTU will go to the end without fragmentation, and then set the "don't fragment" bit in the appropriate packets. There is no totally general solution to this problem, which is why one of the goals of IPv6 is to avoid NAT.
Applications affected by NAT Some higher-layer protocols (such as FTP and SIP) send network layer address information inside application payloads. FTP in active mode, for example, uses separate connections for control traffic (commands) and for data traffic (file contents). When requesting a file transfer, the host making the request identifies the corresponding data connection by its network layer and transport layer addresses. If the host making the request lies behind a simple NAT firewall, the translation of the IP address and/or TCP port number makes the information received by the server invalid. This article is about the File Transfer Protocol standardised by the IETF. For other file transfer protocols, see File transfer protocol (disambiguation). ...
The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol for creating, modifying, and terminating sessions with one or more participants. ...
The network layer is third layer out of seven in OSI model and it is the third layer out of five in TCP/IP model. ...
The application layer is the seventh level of the seven-layer OSI model. ...
This article is about the File Transfer Protocol standardised by the IETF. For other file transfer protocols, see File transfer protocol (disambiguation). ...
The Open Systems Interconnection Basic Reference Model (OSI Reference Model or OSI Model for short) is a layered, abstract description for communications and computer network protocol design, developed as part of the Open Systems Interconnection (OSI) initiative. ...
The Open Systems Interconnection Basic Reference Model (OSI Reference Model or OSI Model for short) is a layered, abstract description for communications and computer network protocol design, developed as part of the Open Systems Interconnection (OSI) initiative. ...
An Application Layer Gateway (ALG) can fix this problem. An ALG software module running on a NAT firewall device updates any payload data made invalid by address translation. ALGs obviously need to understand the higher-layer protocol that they need to fix, and so each protocol with this problem requires a separate ALG. An Application Layer Gateway ( ALG ) is a SIP Back to Back User Agent ( B2BUA ). An ALG can be used to allow firewall traversal with SIP. If the firewall has its SIP traffic terminated on an ALG then the responsibility for permitting SIP sessions is passed onto the ALG instead...
An Application Layer Gateway ( ALG ) is a SIP Back to Back User Agent ( B2BUA ). An ALG can be used to allow firewall traversal with SIP. If the firewall has its SIP traffic terminated on an ALG then the responsibility for permitting SIP sessions is passed onto the ALG instead...
Another possible solution to this problem is to use NAT traversal techniques using protocols such as STUN or ICE or proprietary approaches in a session border controller. NAT traversal is possible in both TCP- and UDP-based applications, but the UDP-based technique is simpler, more widely understood, and more compatible with legacy NATs. In either case, the high level protocol must be designed with NAT traversal in mind, and it does not work reliably across symmetric NATs or other poorly-behaved legacy NATs. NAT traversal refers to a solution to the common problem in TCP/IP networking of establishing connections between hosts in private TCP/IP networks which use NAT devices. ...
This article is about the Internet protocol. ...
The Interactive Connectivity Establishment (ICE) draft, developed by the IETFs MMUSIC working group, provides a mechanism for NAT traversal, using various techniques. ...
A Session Border Controller (SBC) is a device used in some VoIP networks to exert control over the signaling and media streams involved in setting up, conducting, and tearing down calls. ...
In Computing UDP Hole Punching refers to a commonly used NAT Traversal Technique. ...
Other possibilities are UPnP (Universal Plug and Play) or Bonjour (NAT-PMP), but these require the cooperation of the NAT device. Universal Plug and Play (UPnP) is a set of computer network protocols promulgated by the UPnP Forum. ...
Bonjour, formerly Rendezvous, is Apple Inc. ...
NAT Port Mapping Protocol (NAT-PMP) is an Internet Engineering Task Force Internet Draft, introduced by Apple Computer as an alternative to the more common UPnP (Universal Plug and Play) protocol implemented in many network address translation (NAT) routers. ...
Most traditional client-server protocols (FTP being the main exception), however, do not send layer 3 contact information and therefore do not require any special treatment by NATs. In fact, avoiding NAT complications is practically a requirement when designing new higher-layer protocols today.
NATs can also cause problems where IPsec encryption is applied and in cases where multiple devices such as SIP phones are located behind a NAT. Phones which encrypt their signalling with IPsec encapsulate the port information within the IPsec packet meaning that NA(P)T devices cannot access and translate the port. In these cases the NA(P)T devices revert to simple NAT operation. This means that all traffic returning to the NAT will be mapped onto one client causing the service to fail. There are a couple of solutions to this problem, one is to use TLS which operates at level 4 in the OSI Reference Model and therefore does not mask the port number, or to Encapsulate the IPsec within UDP - the latter being the solution chosen by TISPAN to achieve secure NAT traversal. IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by authenticating and/or encrypting each IP packet in a data stream. ...
The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol for creating, modifying, and terminating sessions with one or more participants. ...
Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide secure communications on the Internet for such things as web browsing, e-mail, Internet faxing, instant messaging and other data transfers. ...
The Open Systems Interconnection Reference Model (OSI Model or OSI Reference Model for short) is a layered abstract description for communications and computer network protocol design, developed as part of the Open Systems Interconnect initiative. ...
User Datagram Protocol (UDP) is one of the core protocols of the Internet protocol suite. ...
The Telecoms & Internet converged Services & Protocols for Advanced Networks (TISPAN) is a standardization body of ETSI, specializing in fixed networks and Internet convergence. ...
Different types of NAT | | Some statements in this section may be misleading.
Please help clarify this article. Suggestions may be on the talk page. | Applications that deal with NAT sometimes need to characterize NAT by type. The STUN protocol proposed to characterize Network address translation as Full cone NAT, restricted cone NAT, port restricted cone NAT or symmetric NAT.[3][4] Image File history File links Emblem-important. ...
Full cone NAT, also known as one-to-one NAT - All ports for the external address are mapped to a specific internal address and the same port.
An external host can send an arbitrary packet to the internal host by sending the packet to the mapped external address. | | Restricted cone NAT - All requests from the same internal IP address and port are mapped to the same external IP address and port;
- An external host can send a packet to the internal host only if the internal host had previously sent a packet to it.
| | | Port restricted cone NAT (sometimes called symmetric NAT) Like a restricted cone NAT, but the restriction includes port numbers. Image File history File links Full_Cone_NAT.svg‎ File links The following pages on the English Wikipedia link to this file (pages on other projects are not listed): Network address translation ...
Image File history File links Restricted_Cone_NAT.svg‎ File links The following pages on the English Wikipedia link to this file (pages on other projects are not listed): Network address translation ...
- An external host(ehost:port1) can send a packet to a particular port on the internal host(ihost:port2) only if the internal host(ihost:port2) had previously sent a packet from that port to the external host(ehost:port1).
| | Symmetric NAT - Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port.
- If the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used.
- Only an external host that receives a packet from an internal host can send a packet back.
| | This terminology has been the source of much confusion, as it has proven inadequate at describing real-life NAT behavior.[5] Many NAT implementations combine the specified types, and it is therefore better to refer to specific individual NAT behaviors instead of using the Cone/Symmetric terminology. Especially, most NAT translators combine symmetric NAT for outgoing connections with a static port mapping capability. The latter means that all incoming packets to the specific external address and port can be redirected to a specific internal address and port. Some products can redirect packets to several internal hosts - e.g. to divide the load between a few servers (however, this introduces problems with more sophisticated communications having many interconnected packets and thus is rarely used. Image File history File links Port_Restricted_Cone_NAT.svg‎ File links The following pages on the English Wikipedia link to this file (pages on other projects are not listed): Network address translation ...
Image File history File links Symmetric_NAT.svg‎ File links The following pages on the English Wikipedia link to this file (pages on other projects are not listed): Network address translation ...
Many NAT implementations follow a port preservation design. For most communications, they will use the same values as internal and external port numbers. However, if two internal hosts attempt to communicate with the same external host using the same port number, the external port number used by the second host will be chosen at random. Such NAT will be sometimes perceived as restricted cone NAT and other times as symmetric NAT.
Other examples of use - Load Balancing: Destination NAT can redirect connections pointed at some server to randomly selected servers.
- Failover: Destination NAT can be used to set up a service requiring high availability. If a system involves a critical server accessed through a router, and if the router detects that server has gone down, it could use destination NAT to transparently re-route a connection to arrive on a backup server.
- Transparent proxying: NAT can redirect HTTP connections targeted at the Internet to a special HTTP proxy which can cache content and filter requests. Some internet service providers use this technique to reduce bandwidth usage without requiring their clients to configure their web browser for proxy support.
- Overlapping Networks: Advanced NAT configurations can connect two networks that have overlapping addresses, such as Private addresses, and this is a very useful feature for companies that have just started to merge their networks. This requires that both Source & Destination IP addresses be replaced at the same time, fooling each other's networks.
In computer networking, load balancing is a technique (usually performed by load balancers) to spread work between many computers, processes, hard disks or other resources in order to get optimal resource utilization and decrease computing time. ...
Failover is the capability to switch over automatically to a redundant or standby computer server, system, or network upon the failure or abnormal termination of the previously active server, system, or network. ...
In computer networks, a proxy server is a server (a computer system or an application program) which services the requests of its clients by forwarding requests to other servers. ...
“ISP†redirects here. ...
An example of a Web browser (Mozilla Firefox) A web browser is a software application that enables a user to display and interact with text, images, videos, music and other information typically located on a Web page at a website on the World Wide Web or a local area network. ...
See also It has been suggested that this article or section be merged with Port forwarding. ...
This article is about the network security device. ...
In computer networks, a proxy server is a server (a computer system or an application program) which services the requests of its clients by forwarding requests to other servers. ...
A middlebox is a device in the Internet that provides transport policy enforcement. ...
This article is about routing (or routeing) in computer networks. ...
In telecommunications, the term gateway has the following meanings: In a communications network, a network node equipped for interfacing with another network that uses different protocols. ...
A graphic representation of relationships and source of the various variables representing a chunk of C subnets In computer networks, a subnetwork or subnet is a range of logical addresses within the address space that is assigned to an organization. ...
Internet Protocol version 6 (IPv6) is a network layer protocol for packet-switched internetworks. ...
In Computing UDP Hole Punching refers to a commonly used NAT Traversal Technique. ...
Anything In Anything (AYIYA) Many users are currently located behind NAT NATs which prohibit the usage of proto-41 IPv6 in IPv4 tunnels [RFC3056] unless they manually reconfigure their NAT setup which in some cases is impossible as the NAT cannot be configured to forward proto-41 [RFC1933] to...
Internet addressing growth map. ...
It has been suggested that this article or section be merged with private network. ...
Internet Connection Sharing (ICS) is the name given by Microsoft to a feature in newer versions of its Windows operating system (as of Windows 98 Second Edition) for sharing a single Internet connection on one computer between other computers on the same local area network. ...
It has been suggested that this article or section be merged with Port address translation. ...
This article is about the Internet protocol. ...
Teredo is a tunneling protocol designed to grant IPv6 connectivity to nodes that are located behind IPv6-unaware NAT devices. ...
Universal Plug and Play (UPnP) comes with a solution for Network Address Translation (NAT) traversal. ...
Popular NAT software IPFilter (commonly referred to as ipf) is a software package that can be used to provide network address translation (NAT) or firewall services. ...
PF (Packet Filter, also written pf) is a BSD licensed stateful packet filter, a central piece of software for firewalling. ...
Netfilter is the set of hooks within the Linux kernel for intercepting and manipulating network packets. ...
BSD redirects here. ...
Internet Connection Sharing (ICS) is the name given by Microsoft to a feature in newer versions of its Windows operating system (as of Windows 98 Second Edition) for sharing a single Internet connection on one computer between other computers on the same local area network. ...
WinGate is an integrated Internet Gateway Management system. ...
Cisco IOS (originally Internetwork Operating System) is the software used on the vast majority of Cisco Systems routers and all current Cisco network switches. ...
References Look up December in Wiktionary, the free dictionary. ...
Also see: 2002 (number). ...
For other uses, see May (disambiguation). ...
Year 2007 (MMVII) is the current year, a common year starting on Monday of the Gregorian calendar and the AD/CE era in the 21st century. ...
This article is about the Internet protocol. ...
The Internet Engineering Task Force (IETF) is charged with developing and promoting Internet standards. ...
Year 2007 (MMVII) is the current year, a common year starting on Monday of the Gregorian calendar and the AD/CE era in the 21st century. ...
is the 241st day of the year (242nd in leap years) in the Gregorian calendar. ...
External links eMule is a peer-to-peer file sharing application for Microsoft Windows. ...
|
Feeds |
Contact