Network Address Translation

Overview

Network Address Translation (NAT) refers to a mechanism for rewriting identifying information in packets transitting through a router. It was primarily introduced as a stopgap measure for mitigating the rapid depletion of available IPv4 addresses.

The two most basic scenarios NAT is used for are:

1. Sending IP datagrams from a private address.
   1. The NAT rewrites the source IP address to that of the NAT's external interface.
2. Receiving IP datagrams designated for the NAT.
   1. The NAT rewrites the destination IP address to that of the private address.

Most NATs perform both translation and packet-filtering. If a NAT must also update the application payload itself (as in e.g. FTP), we call the NAT a NAT editor.

On Linux, NAT is called IP masquerading.

Traditional

A traditional NAT refers to either a basic NAT or Network Address Port Translation (NAPT):

• Basic NATs perform rewriting of IP addresses only. As such, it is significantly less popular than NAPTs.
• NAPT uses IP addresses and transport-layer identifiers (i.e. ports for TCP and UDP) to differentiate hosts on the private side of the NAT.

In both cases, the addresses behind the NAT are configured by the local network administrator. Typically these addresses fall within the following special IPv4 address ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

A NAT typically manages a per-connection NAT session with the internal state required to correctly forward and receive packets. At a minimum this state includes a NAT mapping used to pair private IP addresses from public ones sourced from the NAT pool.

Pooling Behavior

A host behind a NAT can open multiple simultaneous connections. A NAT's pooling behavior is said to be paired if the mappings for the simultaneous connections are assigned the same external IP address. It is arbitrary if no retriction is enforced.

Pairing is the recommended behavior for all transports.

Translation Behavior

Suppose a NAT creates mappings X1:x1 and X2:x2 (not necessarily distinct) in response to an internal host at X:x accessing external host Y1:y1 and then external host Y2:y2 (not necessarily distinct). There are three translation behaviors to consider:

• Endpoint-Independent. X1:x1 = X2:x2 for all Y2:y2.
• Address-Dependent. X1:x1 = X2:x2 if and only if Y1 = Y2.
• Address- and Port-Dependent. X1:x1 = X2:x2 if and only if Y1:y1 = Y2:y2.

Endpoint-independent behavior is required for common transport-layer protocols including TCP and UDP.

If the mapping uses the same port as that of the internal host when establishing a connection, we say the NAT respects port preservation.

Filtering Behavior

Suppose a NAT creates mappings X1:x1 and X2:x2 (not necessarily distinct) in response to an internal host at X:x accessing external host Y1:y1 and then external host Y2:y2 (not necessarily distinct). There are three filtering behaviors to consider:

• Endpoint-Independent. Traffic is permitted from any destination if X1:x1 exists.
• Address-Dependent. Traffic is permitted from Y1:y1 if X:x contacted Y1.
• Address- and Port-Dependent. Traffic is permitted from Y1:y1 if X:x contacted Y1:y1.

Classifications

Certain combinations of translation and filtering behavior are given a special name:

Port Forwarding

A NAT must be statically configured to send any incoming traffic to servers sitting behind the NAT. This is called port forwarding (or port mapping). Note that a NAT has only one set of port numbers for each of its (external IP addresses, transport protocol) combinations.

Hairpinning

NAT hairpinning (or NAT loopback) refers to the scenario in which a client behind a NAT wishes to reach a server behind the same NAT using public address information.

Using the above scenario, suppose X1:x1 contacts X2:x2 using external IP address X2':x2'. We say the NAT has "external source IP address and port" hairpinning behavior if the source address is rewritten to X1':x1'. We say the NAT has "internal source IP address and port" hairpinning behavior if the source address remains X1:x1.