§4.3.3Network Address Translation (NAT)

Network layer Kurose & Ross pp. 344–346 · ~12 min read

  • network address translation
  • middlebox

Where you are

  • Application layer
  • Transport layer
  • Network layer you are here
  • Link layer
  • Physical layer

A whole home network hides behind one public address. The router works out which machine each reply belongs to from the port number — a field meant for naming processes, not hosts.

Words you will meet

  • Network address translation ( NAT (Network Address Translation) ) — rewriting addresses and ports so many hosts can share one public address.
  • Private address — an address meaningful only inside one network. Reserved by [RFC 1918].
  • WAN (Wide Area Network) side / LAN (Local Area Network) side — the router’s public interface and its home-facing one.
  • NAT translation table — the rows mapping a WAN-side address and port to a LAN-side one.
  • SOHO (Small Office, Home Office) — small office, home office. The setting this was invented for.
  • NAT traversal — the tools needed to reach a host that is behind a NAT.

Why this matters

Every IP (Internet Protocol) -capable device needs an address. A home now has phones, tablets, gaming devices, televisions and printers. On the face of it the ISP (Internet Service Provider) would have to allocate a block big enough for all of them, then a bigger block when the household buys something else.

Two problems with that. The ISP may already have allocated the addresses next to yours, so the block cannot grow. And what homeowner wants, or should need, to know how to manage IP addresses at all?

NAT (Network Address Translation) makes the whole question go away, and it is one of the two reasons the 32-bit address space has lasted three decades past the point it should have run out. Section 4.3.4 is the other.

It also breaks things, and the book is direct about that. This page covers both.

Private addresses

All four interfaces in the home network of Figure 4.25 share the subnet address 10.0.0.0/24. That block sits inside 10.0.0.0/8, one of three ranges [RFC 1918] reserves for private networks.

The three private blocks

The book names only the first. All three are worth knowing, because you will recognise every one of them in the wild:

BlockAddressesWhere you see it
10.0.0.0/816,777,216large private networks, and the book’s example
172.16.0.0/121,048,576the one people forget; it is a /12, not a /16
192.168.0.0/1665,536almost every home router you have ever used
The private address space this home is using
the address10.0.0.100001010.00000000.00000000.00000001
the mask255.0.0.011111111.00000000.00000000.00000000
subnet10.0.0.0/800001010.00000000.00000000.00000000
last address10.255.255.25500001010.11111111.11111111.11111111
addresses in the block
16,777,216
usable for interfaces
16,777,214
host bits
24

The shaded bits are the network prefix — the 8 bits every interface on this subnet shares. The rest identify one interface within it. Two of the 16,777,216 are reserved: 10.0.0.0 names the subnet itself and 10.255.255.255 is its broadcast address, which is why the usable count is 16,777,216 − 2.

Set the prefix to 8 for the whole reserved block, then to 24 for the home network in Figure 4.25. The /8 holds over sixteen million addresses — and every one of them is being used by hundreds of thousands of homes at once.

A realm with private addresses is a network whose addresses have meaning only to devices within it. That is the crucial property, and it is what makes the arithmetic work:

There are hundreds of thousands of home networks, many using the same address space, 10.0.0.0/24.

Devices inside one home can send to each other using those addresses perfectly well. But a packet leaving the home cannot use them as a source or destination, because hundreds of thousands of networks are using the same block. The address would not identify anything.

What the router does

The NAT-enabled router does not look like a router to the outside world. It behaves as a single device with a single IP address.

All traffic leaving the home has source 138.76.29.7. All traffic entering must have destination 138.76.29.7. The router is hiding the entire home network behind one address.

Figure 4.25 — one datagram, four headers
1 — The host sends, using a private addressstep 1 of 4
host 10.0.0.1NAT routerLAN 10.0.0.4 · WAN 138.76.29.7web server128.119.40.186:80S = 10.0.0.1, 3345D = 128.119.40.186, 80

Host 10.0.0.1 picks an arbitrary source port, 3345, and sends towards the web server. Its source address is private: it means nothing outside this home, and hundreds of thousands of other homes are using the same one right now.

The book’s own numbered steps. Watch the source line on the way out and the destination line on the way back — those are the only two things NAT ever changes, and it changes both halves of each.

Read all steps as text
  1. 1 — The host sends, using a private addressHost 10.0.0.1 picks an arbitrary source port, 3345, and sends towards the web server. Its source address is private: it means nothing outside this home, and hundreds of thousands of other homes are using the same one right now.
  2. 2 — The router rewrites the source and records the mappingIt replaces the source address with its own WAN-side address 138.76.29.7, and the source port 3345 with a new one, 5001 — any port not already in its table. Then it writes the pair into the NAT translation table, because that row is the only way home.
  3. 3 — The server replies to the only address it ever sawThe web server is blissfully unaware that anything was manipulated. It answers the datagram it received, so its reply is addressed to 138.76.29.7 port 5001. It has never heard of 10.0.0.1 and never will.
  4. 4 — The router looks up the row and rewrites the destinationEvery datagram arriving from the Internet has the same destination address, so the address alone cannot say which host it is for. The router indexes its table by destination address AND destination port, finds 10.0.0.1 and 3345, rewrites both, and forwards. The port number is doing the work.

Why the port number is doing the real work

Every datagram arriving from the Internet has the same destination address — the router’s WAN-side one. So the address cannot possibly say which of the home machines it is for.

The trick is that the translation table is indexed by address and port, and the router hands out a fresh WAN-side port for every connection. When generating one it may choose any port not currently in the table.

Because the port field is 16 bits, a single WAN-side address supports over 60,000 simultaneous connections.

The NAT translation table
WAN sideLAN sideWhat this row is

Cells marked ⓘ have an explanation — click to read it.

Two columns, and the port numbers are what make it work. Without them every row would have the same WAN-side address and the table could not tell the hosts apart.

Look at the second row. Two different hosts both chose source port 3345 — nothing stops them, since inside the home they are told apart by address. Outside, the only thing distinguishing them is the WAN-side port the router assigned. That is why it must assign a new one rather than passing the original through.

Where the addresses come from — all of them

The book asks the obvious question in an aside: where do the home computers get their addresses, and where does the router get its single public one?

Often the answer is the same: DHCP (Dynamic Host Configuration Protocol) .

  • The router gets its WAN-side address from the ISP’s DHCP server.
  • The router runs a DHCP server itself, handing out 10.0.0.x addresses to the machines in the home.

So the box in the hall is simultaneously a DHCP client, a DHCP server, a router and a NAT. Section 4.3.2-dhcp’s four-message exchange is happening on both of its interfaces, for different reasons.

What NAT breaks

The book is not neutral about this, and the objections are worth taking seriously.

Objection 1 — port numbers are being used for the wrong thing

Port numbers are meant to address processes, not hosts. NAT uses them to address hosts.

The consequence is concrete. Section 2.7 showed a server process waiting for incoming requests at a well-known port. A peer in a peer-to-peer protocol must do the same when acting as a server.

But an incoming connection to a host behind a NAT has nowhere to go. The translation table has no row for it, because rows are created by outgoing datagrams. So the router does not know which machine the connection is for, and drops it.

How can one peer connect to another peer that is behind a NAT, with a DHCP-provided address? The answer is a family of NAT traversal tools [RFC 5389, RFC 5128, Ford 2005], and their existence is the clearest evidence that something was broken.

Objection 2 — a layer-3 device is reading layer-4 fields

The architectural complaint. Routers are meant to be network-layer devices and should process packets only up to the network layer.

NAT violates the principle that hosts talk directly to each other, without interfering nodes modifying their IP addresses. Much less their port numbers, which belong to a layer the router has no business inspecting.

Compare it with what section 4.3.1 said about the upper-layer protocol field: it is read only at the final destination, and no router in between needs it. NAT reads and rewrites a field one layer above even that.

Section 4.5 returns to this debate under a broader heading: middleboxes . NAT turns out to be one member of a large family, and the argument has two respectable sides.

The security sidebar: firewalls and intrusion detection

The book places a sidebar here, because a NAT box is usually also the thing inspecting your traffic. Attackers who know your address range can send datagrams into it. They map the network with ping sweeps and port scans, crash hosts with malformed packets, scan for open ports, or carry malware.

A firewall inspects datagram and segment header fields and denies suspicious datagrams entry. It might block all ICMP (Internet Control Message Protocol) echo requests, which prevents a traditional port scan across your address range. It can block on source and destination addresses and port numbers. It can also track TCP (Transmission Control Protocol) connections, admitting only datagrams belonging to approved ones. Most access routers today have firewall capability.

An intrusion detection system ( IDS (Intrusion Detection System) ) goes further. Sitting at the network boundary, it performs deep packet inspection, examining not only headers but the payload, including application-layer data. It matches what it finds against a database of packet signatures known to belong to attacks. The database updates itself as new attacks are found. An intrusion prevention system ( IPS (Intrusion Prevention System) ) is the same thing that also blocks, rather than only alerting.

Can they fully shield a network? Clearly no. Attackers continually find new attacks for which no signature yet exists. Firewalls and signature-based detection are useful against known attacks, which is a real but bounded claim. Chapter 8 returns to all of it.

Check yourself

Check yourself

0 of 7 answered
  1. 1.predictEvery datagram arriving from the Internet has the same destination address — the router's WAN-side one. So how does the router know which home machine it is for?

  2. 2.Which fields does NAT rewrite on an outgoing datagram?

  3. 3.predictSomeone on the Internet tries to open a connection to a machine behind a NAT. What happens?

  4. 4.Hundreds of thousands of homes use 10.0.0.0/24 at the same time. Why is that not a catastrophe?

  5. 5.Where does a home router get its own public address, and where do the home machines get theirs?

  6. 6.What is the architectural objection to NAT?

  7. 7.The book asks whether firewalls and intrusion detection systems can fully shield a network. What is its answer?

What to remember

  • NAT lets a whole network share one public address, which is a large part of why the 32-bit address space has lasted. To the outside world the router is a single device with a single address.
  • The translation table is indexed by address and port, because the address alone is the same for every arriving datagram. The router assigns a fresh WAN-side port per connection, and 16 bits allow over 60,000 at once.
  • Rows are created by outgoing datagrams. That is why an unsolicited incoming connection has nowhere to go, and why NAT traversal tools exist.