Network address translation

From Wikipedia, the free encyclopedia
  (Redirected from IP masquerading)
Jump to: navigation, search

Network Address Translation (NAT) is a network protocol used in IPv4 networks that allows multiple devices to connect to a public network using the same public IPv4 address. NAT was originally designed in an attempt to help conserve IPv4 addresses.[1] NAT modifies the IP address information in IPv4 headers while in transit across a traffic routing device. This presents some drawbacks in terms of the quality of Internet connectivity and requires careful attention to the details of its implementation. In particular, all types of NAT break the originally envisioned model of IP end-to-end connectivity across the Internet and NAPT makes it difficult for systems behind a NAT to accept incoming communications. As a result, NAT traversal methods have been devised to alleviate the issues encountered. NAT has become a common, indispensable feature in routers for home and small-office Internet connections.

Basic NAT[edit]

The simplest type of NAT provides a one-to-one translation of IP addresses. RFC 2663 refers to this type of NAT as basic NAT, which is often also called a one-to-one NAT. In this type of NAT only the IP addresses, IP header checksum and any higher level checksums that include the IP address are changed. The rest of the packet is left untouched (at least for basic TCP/UDP functionality; some higher level protocols may need further translation). Basic NATs can be used to interconnect two IP networks that have incompatible addressing.

However, it is common to hide an entire IP address space, usually consisting of private IP addresses, behind a single IP address (or in some cases a small group of IP addresses) in another (usually public) address space. To avoid ambiguity in the handling of returned packets, a one-to-many NAT must alter higher level information such as TCP/UDP ports in outgoing communications and must maintain a translation table so that return packets can be correctly translated back. RFC 2663 uses the term NAPT (network address and port translation) for this type of NAT. Other names include PAT (port address translation), IP masquerading, NAT Overload and many-to-one NAT. Since this is the most common type of NAT it is often referred to simply as NAT.


One-to-many NATs[edit]




Methods of port translation[edit]


  • Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort will be sent through eAddr:ePort.
Full Cone NAT.svg
(Address)-restricted-cone NAT
Restricted Cone NAT.svg
Port-restricted cone NAT


Port Restricted Cone NAT.svg
Symmetric NAT
  • Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port, if the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used.
Symmetric NAT.svg







However, if two internal hosts attempt to communicate with the same external host using the same port number, the external port number used by the second host will be chosen at random. Such NAT will be sometimes perceived as (address) restricted cone NAT and other times as symmetric NAT.

Recent studies have shown that roughly 70% of clients in P2P networks employ some form of NAT.[4]


Establishing two-way communication[edit]





An analogy[edit]


Translation of the endpoint[edit]



NAT will only translate IP addresses and ports of its internal hosts, hiding the true endpoint of an internal host on a private network.

Visibility of operation[edit]



NAT and TCP/UDP[edit]









The meaning of the term SNAT varies by vendor. Many vendors have proprietary definitions for SNAT. A common expansion is source NAT, the counterpart of destination NAT (DNAT). Microsoft uses the acronym for Secure NAT, in regard to the ISA Server. For Cisco Systems, SNAT means stateful NAT. For Watchguard Systems, SNAT means static NAT. For F5 Networks, the term means Secure NAT.


Secure NAT[edit]

In computer networking, the process of network address translation done in a secure way involves rewriting the source and/or destination addresses of IP packets as they pass through a router or firewall.

Dynamic network address translation[edit]


NAT loopback[edit]

Also known as NAT hairpinning or NAT reflection.[6]

NAT loopback is a feature in many consumer routers[7] which allows a user to connect to its own public IP address from inside the LAN-network. This is especially useful when a website (with domain) is hosted at that IP address. Consider the following network:

  • Internal address of router:
  • Address of the server:
  • Address of a computer:

When a packet is sent to (public address) by (a computer), the packet would normally be sent to the default gateway (the router). An exception could be made in the computer's routing tables, but by default the default gateway will be used. A router with the NAT-loopback feature will detect that is the address of its WAN interface, and treat the packet as if coming from that interface. It decides based on DNAT (port forwarding) rules where the packet should go. For example, if the data were sent to port 80 and there is a DNAT rule for port 80 to go to, it will send the packet there.

If no applicable DNAT rules are available, the router's firewall will drop the packet. An ICMP Destination Unreachable reply may or may not be sent. Note that if any DNAT rules were found, address translation is still in effect; the router still rewrites the source IP address in the packet. The computer ( will send the packet as coming from, but just like when a packet was sent to any global IP address, the server ( will receive it as coming from When a reply is made by the server, the same thing happens again. The packet goes to the server's default gateway (the router), which will find the source and destination port in its NAT tables, and know that it originated from This way, two-way communication is possible between hosts inside the LAN network via their public IP address.

NAT loopback is especially useful when a domain is hosted on the server. The domain name will resolve, unless the user is running a custom DNS server and has made an exception, to the public address. When the router does not have NAT loopback, any connection attempts to that IP address are discarded and time out. A workaround is to include the domain name in the hosts file,[8] but all subdomains would have to be included as well, and all devices in the LAN network would need to have the same modifications. Example entries for the hosts file, following the above network setup:


NAT loopback is sometimes rumored to be a security issue[9] and may be said to provide LAND attacks, but this is incorrect.[10] No technical grounds are known for the security accusations.


NAT in IPv6[edit]

Network address translation will not be commonly used in IPv6, so NAT loopback will not be commonly needed. Although still possible, there is no reason to use NAT anymore because there is a much larger address space and every device can be given its own globally routable address. When NAT is used though, NAT loopback will work the same way as in IPv4. Without NAT, a packet can be sent to the public address of the server from any client (including clients inside the same LAN network), because it will detect that the destination is in the same IP subnet. This can already be shown on dual-stack networks.

traceroute to
1 router.local ( 0.565 ms 0.670 ms 0.779 ms
2 ( 1.053 ms 1.203 ms 1.109 ms
traceroute to 2001:db8::2
1 (2001:db8::2) 1.074 ms 1.074 ms 1.299 ms

Note that both the client and server must support IPv6 and IPv4 addressing in the above scenario. Also note that 2001:db8::2 is the IPv6 IP address of the server (which was in the IPv4 example).

In the first example the packet was first sent to the default gateway since is not inside the same subnet as Then the router, performing NAT loopback, forwards it to the configured device (

In the second example the client detected that it was inside the same IPv6 subnet as the server, and sent the packet there directly.

Applications affected by NAT[edit]




Other possibilities are UPnP Internet Gateway Device Protocol, NAT-PMP (NAT Port Mapping Protocol), or Port Control Protocol (PCP),[11] but these require the NAT device to implement that protocol.





Advantages of PAT[edit]

In addition to the advantages provided by NAT:

  • PAT (Port Address Translation) allows many internal hosts to share a single external IP address.
  • Users who do not require support for inbound connections do not consume public IP addresses.

Drawbacks of PAT[edit]

The primary purpose of IP-masquerading NAT is that it has been a practical solution to the impending exhaustion of IPv4 address space. Even large networks can be connected to the Internet with as little as a single IP address. The more common arrangement is having machines that require end-to-end connectivity supplied with a routable IP address, while having machines that do not provide services to outside users behind NAT with only a few IP addresses used to enable Internet access, however, this brings some problems, outlined below.

Some[12] have also called this exact feature a major drawback, since it delays the need for the implementation of IPv6:









IETF[16] RAPT (IP Reachability Using Twice Network Address and Port Translation) The RAT device maps an IP datagram to its associated CN and 0MN by using three additional fields: the IP protocol type number and the transport layer source and destination connection identifiers (e.g. TCP port number or ICMP echo request/reply ID field).

Cisco RAPT implementation is PAT (Port Address Translation) or NAT overloading, and maps multiple private IP addresses to a single public IP address. Multiple addresses can be mapped to a single address because each private address is tracked by a port number. PAT uses unique source port numbers on the inside global IP address to distinguish between translations. The port number is encoded in 16 bits. The total number of internal addresses that can be translated to one external address could theoretically be as high as 65,536 per IP address. Realistically, the number of ports that can be assigned a single IP address is around 4000. PAT will attempt to preserve the original source port. If this source port is already used, PAT will assign the first available port number starting from the beginning of the appropriate port group 0-511, 512-1023, or 1024-65535. When there are no more ports available and there is more than one external IP address configured, PAT moves to the next IP address to try to allocate the original source port again. This process continues until it runs out of available ports and external IP addresses.


3COM U.S. Patent 6,055,236 (Method and system for locating network services with distributed network address translation) Methods and system for locating network services with distributed network address translation. Digital certificates are created that allow an external network device on an external network, such as the Internet, to request a service from an internal network device on an internal distributed network address translation network, such as a stub local area network. The digital certificates include information obtained with a Port Allocation Protocol used for distributed network address translation. The digital certificates are published on the internal network so they are accessible to external network devices. An external network device retrieves a digital certificate, extracts appropriate information, and sends a service request packet to an internal network device on an internal distributed network address translation network. The external network device is able to locate and request a service from an internal network device. An external network device can also request a security service, such as an Internet Protocol security ("IPsec") service from an internal network device. The external network device and the internal network device can establish a security service (e.g., Internet Key Exchange protocol service). The internal network device and external network device can then establish a Security Association using Security Parameter Indexes ("SPI") obtained using a distributed network address translation protocol. External network devices can request services, and security services on internal network devices on an internal distribute network address translation network that were previously unknown and unavailable to the external network devices.

Examples of NAT software[edit]

See also[edit]


  1. ^
  6. ^
  7. ^
  8. ^
  9. ^
  10. ^
  15. ^
  16. ^

External links[edit]