Network address translation

Why it exists

IPv4 has only $2^{32}$ addresses, fewer than the number of devices. Network address translation lets a whole home or company network, using private addresses that are valid only inside, share one public address when it talks to the Internet. The NAT router rewrites the addresses (and port numbers) of packets that pass through it. GATE asks how the translation table works and what its limits are.

Prerequisites

You need the private address ranges and the structure of an IPv4 address (IPv4 addressing). Ports are the transport-layer identifiers of processes (TCP segments and UDP datagrams carry a source and destination port of $16$ bits, TCP).

Precise definitions

Private addresses (RFC 1918, quoted): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. They can be used by anybody inside their own network but are never routed on the public Internet.

A NAT router sits between the private network and the Internet and has one (or a few) public addresses. In the common form, NAPT (network address and port translation, also called PAT or "masquerading"):

• For a packet leaving the private network, it replaces the source address and source port by its own public address and a new, unused public port, and stores the pair in the NAT translation table: public port ↔ (private address, private port).
• For a packet arriving from outside with a destination port that is in the table, it replaces the destination address and port by the private ones and forwards it inside. If the port is not in the table, the router has no way to decide which host is meant and drops the packet.
• The router recomputes the IP header checksum and the TCP/UDP checksum (which covers the addresses and ports) for every rewritten packet.

Entries are created by the first outgoing packet of a connection and removed when the connection ends or after a timeout of silence.

How it works

The first host 10.0.0.1 opens a connection from its private port $3345$ to a web server 128.119.40.186:80. The NAT router, whose public address is 128.119.40.1, assigns the public port $1024$ and writes 1024 ↔ 10.0.0.1:3345. The server sees a connection from 128.119.40.1:1024 and answers to that endpoint; the router looks up port $1024$ and rewrites the destination to 10.0.0.1:3345. A second host 10.0.0.2 also uses the private port $3345$: this is possible because the router gives it a different public port $1025$. The ports are the only thing that tells the replies apart, which is why plain address translation (without ports) could serve only one inside host at a time per public address. A packet addressed to the public port $1030$ finds no entry and is dropped.

Capacity. A port number has $16$ bits. In the model of this site the translated ports are $1024 \dots 65535$, so $64\,512$ simultaneous translations are possible with one public address; the number of hosts that can share it follows:

(The exact count depends on the implementation; some NATs can reuse a public port for connections to different remote endpoints, which raises the limit. The usual port range is quoted from common practice.)

Where NAT is configured. Servers inside a private network are reachable from outside only if the administrator creates a static mapping (port forwarding: public port $80$ is forwarded to a private web server).

Worked examples

Cheat box

Traps and GATE patterns

Connections

The private blocks are written in CIDR notation (CIDR). The ports belong to TCP and UDP (TCP, UDP and ports). NAT slows the need for a larger address space, whose permanent answer is IPv6 (outside the syllabus line).

PYQs

Which of the following fields is/are modified in the
IP header of a packet going out of a network address
translation (NAT) device from an internal network to
an external network?

Self-check

Revision card

References